This question already has an answer here:

I am trying to use in DD-WRT iptables to block an ip range Ex: I want to block

iptables -I FORWARD -s -j DROP

but it does not work.

marked as duplicate by sebasth, muru, Fabby, Prvt_Yadv, Stephen Harris Apr 11 at 3:26

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


You need to use the below

iptables -I FORWARD -m iprange --src-range -j DROP


-m, --match match

Specifies a match to use, that is, an extension module that tests for a specific property. The set of matches make up the condition under which a target is invoked. Matches are evaluated first to last as spec‐ ified on the command line and work in short-circuit fashion, i.e. if one extension yields false, evaluation will stop.

  • Thanks for the help, but DD-WRT did not work this command on the firewall – vinibudd Apr 10 at 4:56
  • Yes, iprange is one of iptables extensions modules (kernel module xt_iprange.ko), which are optional: it's possible an embedded Linux distribution may have omitted some of the extensions from its kernel configuration to minimize kernel size or simply packaged them as a separate optional package(s) to allow minimizing storage space usage. – telcoM Apr 10 at 6:45

I just discovered the iptables lock on DD-WRT only works by CIDR


iptables -I FORWARD -s -j DROP
iptables -I FORWARD -s -j DROP
iptables -I FORWARD -s -j DROP
iptables -I FORWARD -s -j DROP

A pity, but perhaps this limitation happens because my construction has little memory

Not the answer you're looking for? Browse other questions tagged or ask your own question.