specifying port ranges-iptables

[s_hcl]

i have a iptable firewall installed on red hat 9.0.I wanted to allow a range of ports say 5000 to 5050 .I tied using 5000:5050 ,but it doesnt seem to work.Can any one help me out with the correct syntax.

iptables version is iptables v1.2.7a:

The command was

iptables -t filter -A FORWARD -s 192.168.1.0/24 -p tcp -m state --state NEW -m multiport --dports 7000:7100 -j ACCEPT

[redhead]

man iptables will show you, that --dports or --destination-ports takes a comma seperated argument mentioning every ports in question, not a port range, so it will be:

#!/bin/sh

PORTS="5000,5001,5002,5003,5004,5005,5006,5007,5008,5009,5010,\
       5011,5012,5013,5014,5015,5016,5017,5018,5019,5020,\
       5021,5022,5023,5024,5025,5026,5027,5028,5029,5030,\
       5031,5032,5033,5034,5035,5036,5037,5038,5039,5040,\
       5041,5042,5043,5044,5045,5046,5047,5048,5049,5050"
iptables -t filter -A FORWARD -s 192.168.1.0/24 -p tcp -m state --state NEW -m multiport --dports $PORTS -j ACCEPT

[s_hcl]

thks for the reply

i tried adding ports from 7000 to 7100 ,but i got an error as

invalid port/service ' ' specified.

[s_hcl]

i checked out in help ,it aloows only 15 ports at a time ,hence i assignes 10 ports at a time

PORTS="7000,7001,7002,7003,7004,7005,7006,7007,700 8,7009,7010"
iptables -t filter -A FORWARD -s 192.168.1.0/24 -p tcp -m state --state NEW -m multiport --dports $PORTS -j ACCEPT

and its wrkg fine now


thks for ur valuable input ,it helped solve the problem ,whcih i was facing for a long time.

[redhead]

You could shorten that to:

PORTS="7000,7001,7002,7003,7004,7005,7006,7007,7008,7009,7010 \
       7011,7012,7013,7014,7015,7016,7017,7018,7019,7020 \
       .... \
       7091,7092,7093,7094,7095,7096,7097,7098,7099,7100"
for RANGE in $PORTS; do
    iptables -t filter -A FORWARD -s 192.168.1.0/24 -p tcp -m state --state NEW -m multiport --dports $RANGE -j ACCEPT
done

Notice the " "(space) befor every newline in the definition of PORTS.
That way you can have all your ports gathered in one variable and run through them in a single line...

[s_hcl]

thks .when i try the command of giving it in a single line ,it gives me an error as

invalid port/service ' ' specified

[s_hcl]

ooops sorry ,i didnt check the for command ,thought it was the same earlier command.I will try and let u know.