7

I can add a rule using UFW firewall to allow a single known IP 192.168.1.32 to access my test webserver (192.168.1.48 (on a local mostly trusted network) on Ubuntu 14.04 using:

sudo ufw allow proto tcp from 192.168.1.23 to 192.168.1.48 port 80

Is there a way I can add a range of addressees (e.g. 192.168.1.30-192.168.1.50 to allow more machines on my current network)? Using 192.168.1.30-192.168.1.50 and 192.168.1.30-192.168.1.50 don't work and results in ERROR: Bad source address.

  • 1
    For 14 hosts (192.168.1.17 to 192.168.1.30) 192.168.1.23/28, For 30 hosts 192.168.1.0/27 (192.168.1.1 - 192.168.1.30) but nothing for 20 hosts. – A.B. Jul 9 '15 at 16:19
  • Where did the previous comments go? The text of the question does not agree with the example ufw line. (?) @A.B. a mask of 28 bits would allow 16 host addresses through and a mask of 27 bits would allow 32 host addresses through. Wouldn't it? Disclaimer: I use iptables and not ufw. – Doug Smythies Jul 9 '15 at 17:13
  • @Doug If it was my comment I might have removed because I couldn't edit it and copied the wrong info :). Both answers (which I think were good :(, and I could give screenshots of if needed) have been deleted though, but here is a screenshot of the thing I think you were replying too – Wilf Jul 9 '15 at 19:48
  • @A.B. the answer you gave worked (the second command did anyways, the first not at all), the addresses I have were ones I was testing from - the one I think I want access from could be in 192.168.1.10-192.168.1.50 (sorry if not clear, they seem to be assigned pretty randomly... ). I was going to test from other addresses but I think your answer could be the solution. BTW, due to having less than 10k, doug can't see your answer. – Wilf Jul 9 '15 at 19:55
  • For 192.168.1.10-192.168.1.50 the nearest, but larger, rule would use 192.168.1.0/26 which would be 192.168.1.0-192.168.1.63 – Doug Smythies Jul 9 '15 at 20:36
4

You need to use a binary number (2,4,8,16, 32) so either you use a bigger or a smaller range. Exactly 20 hosts just is not possible with a bitmask in a single rule:

  • 16 hosts (192.168.1.16 to 192.168.1.31):

    sudo ufw allow proto tcp from  192.168.1.16/28 to 192.168.1.48 port 80
    

    Details

    Address:   192.168.1.16          11000000.10101000.00000001.0001 0000
    Rule Mask: 255.255.255.240 = 28  11111111.11111111.11111111.1111 0000
    Wildcard:  0.0.0.15              00000000.00000000.00000000.0000 1111
    
    HostMin:   192.168.1.16          11000000.10101000.00000001.0001 0000
    HostMax:   192.168.1.31          11000000.10101000.00000001.0000 1111
    
  • 32 hosts (192.168.1.0 - 192.168.1.31)

    sudo ufw allow proto tcp from 192.168.1.0/27 to 192.168.1.48 port 80
    

    Details

    Address:   192.168.1.0           11000000.10101000.00000001.000 00000
    Rule Mask: 255.255.255.224 = 27  11111111.11111111.11111111.111 00000
    Wildcard:  0.0.0.31              00000000.00000000.00000000.000 11111
    
    HostMin:   192.168.1.0           11000000.10101000.00000001.000 00000
    HostMax:   192.168.1.31          11000000.10101000.00000001.000 11111
    
  • 64 hosts (192.168.1.0 - 192.168.1.63)

    sudo ufw allow proto tcp from 192.168.1.0/26 to 192.168.1.48 port 80
    

    Details

    Address:   192.168.1.0           11000000.10101000.00000001.00 000000
    Rule Mask: 255.255.255.192 = 26  11111111.11111111.11111111.11 000000
    Wildcard:  0.0.0.63              00000000.00000000.00000000.00 111111
    
    HostMin:   192.168.1.0           11000000.10101000.00000001.00 000000
    HostMax:   192.168.1.63          11000000.10101000.00000001.00 111111
    

Explanation

I can't give a better explanation than wikipedia

  • Hmmmm.... the second works from IPs 192.168.1.23, 192.168.1.27 and 192.168.1.31, but 192.168.1.0/28 doesn't work with any. What reason is their for constriction on the ranges? – Wilf Jul 9 '15 at 18:05
  • @Wilf Sorry, I can't give a better explanation than wikipedia :\ – A.B. Jul 9 '15 at 18:16
  • @Wilf Only for 192.168.1.23, 192.168.1.27 and 192.168.1.31? – A.B. Jul 9 '15 at 18:20
  • You are are not defining a sub-net with a bit mask allow rule for iptables or ufw. A mask of 28 will allow 16 host addresses and a mask of 27 will allow 32 host addresses through. But yes, it does depend on what your real sub-net mask is, and if you hit the boundaries or not. The 28 bit mask example doesn't overlap the desired range at all, it should be 192.168.1.16/28 to cover 192.168.1.16 through 192.168.1.31 inclusive. – Doug Smythies Jul 9 '15 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.