Defining multiple addresses using only one iptables
command using ! --source
is not possible.
A Address can be either a network name, a hostname (probably a really
bad idea to use hostnames), a network IP address (with /mask), or a plain IP address.
The mask can be either a network mask or a plain number.
You could consider to change the default ruleset from allow to drop. This would allow you to define based on only what should be allowed, i.e. similar like this:
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
... your other rules goes here ...
iptables -A INPUT -m state --state NEW -p tcp --dport 22 -s 1.2.3.4,11.22.33.44 -j ACCEPT
iptables -P INPUT DROP
The benefit/beauty is that such a rule set would be much more performant, as the state of the packages is considered. Plus it allows the desired syntax. Plus is also the recommended way to define firewall rules.
However, please keep in mind that if using a syntax as shown above: -s 1.2.3.4,11.22.33.44
still creates 2 individual table entries, as you can see using the command iptables -L INPUT
. In addition it does not work with all versions of iptables. In addition personally I find it hard to read or to maintain. That's the reason why I try to avoid it, in favour of using 2 separate commands.
In case your desire is to minimize the amount of rules, the closest you could do is to use one iptables
rule using --match
instead --source
. However, you still have to define the match, using additional commands. How this works has been explained perfectly in the other comment which deals with ipset.