Iptables sets all IP except two IP to REJECT

Manage a private network segment with iptables

The experimental machine is 10.10.11.121.

INPUT defaults to DROP and opens port access to all machines in the 10.10.11 + 24 network segment.

But only two machines 10.10.11.41 and 10.10.11.42 can be accessed through port 22.

It is easy to open permissions, and it is also easy to allow only one, but there are very few instances in which all machines other than two machines are prohibited from accessing a certain port at the same time. After experiments, the goal is finally achieved, and special records are available to enjoy:

* filter

: INPUT DROP-all disabled by default

-An INPUT-p tcp-- dport 22-s! 10.10.11.40 dport 30-j REJECT-- only 10.10.11.41 machines in the 10.10.11.0 network segment can ssh connect to this machine through port 22 (the initial two machines have been written as follows:

10.10.11.41,10.10.11.42

10.10.11.41/10.10.11.42

10.10.11.41-10.10.11.42

Or write two lines:

! 10.10.11.41

! 10.10.11.42

None of the above works)

-An INPUT-p tcp-s 10.10.11.0 Universe 24-j ACCEPT-all 10.10.11.0 network segments have access to all other ports