# IPTables IP Range Question

## wswartzendruber

I am trying to state the following:

 *Quote:*   

> /sbin/iptables -A INPUT -i tun0 -s 1.0.0.3-1.255.255.255 -j DROP

 

But it doesn't like the IP range.  I would just say 10.0.0.0/8, but I need 10.0.0.1 and 10.0.0.2 for a point-to-point link.

----------

## Akkara

 *wswartzendruber wrote:*   

> I would just say 10.0.0.0/8, but I need 10.0.0.1 and 10.0.0.2 for a point-to-point link.

 

The way I do it (and I don't know if this is the best way), is to explicitly accept the addresses I want to make it through, and then DROP the 10.0.0.0/8 range.  Rules are processed in order and the first one that matches stops the processing.

Also, if there's a particular high-bandwidth address, I'll list that one near the top with an 'ACCEPT' (or whatever is appropriate) to get it to exit processing sooner, in case the speed of iptables processing makes a difference (I never explicity measured and I don't know if it does).

----------

## wswartzendruber

I just found this:

```
$IPTABLES -A FORWARD -i $TUN -m iprange --src-range 10.0.0.3-10.255.255.255 -j DROP
```

 :Very Happy:   :Very Happy:   :Very Happy: 

----------

