give multible ports a/o ips to iptables [fixed: problems with firehol...]

[Jonas Meurer <jonas@freesources.org>]

On 31/08/2004 Jonas Meurer wrote:
>         [...]
>         iptables -A INPUT -i eth0 -p tcp --dport 210 -j ACCEPT
>         iptables -A OUTPUT -o eth0 -p tcp --sport 210 -j ACCEPT
>         iptables -A INPUT -i eth0 -p tcp --dport 215 -j ACCEPT
>         iptables -A OUTPUT -o eth0 -p tcp --sport 215 -j ACCEPT
>         iptables -A INPUT -i eth0 -p tcp --dport 220 -j ACCEPT
>         iptables -A OUTPUT -o eth0 -p tcp --sport 220 -j ACCEPT
>         iptables -A INPUT -i eth0 -p tcp --dport 225 -j ACCEPT
>         iptables -A OUTPUT -o eth0 -p tcp --sport 225 -j ACCEPT
>         iptables -A INPUT -i eth0 -p tcp --dport 230 -j ACCEPT
>         iptables -A OUTPUT -o eth0 -p tcp --sport 230 -j ACCEPT
> 
> since some weeks, the ftp server doesn't respond to requests on ports
> except 21 and 215 any longer, and i've no glue what the problem could
> be.

now i found the problem: ftpd runs on two ips, 128.98 and 128.99.
for some reason, the iptables rules didn't open ports on all ips.

now i have
        iptables -A INPUT -i eth0 -p tcp -d ??.??.128.98 --dport 210 -j ACCEPT
        iptables -A OUTPUT -o eth0 -p tcp -d ??.??.128.98 --sport 210 -j ACCEPT
        iptables -A INPUT -i eth0 -p tcp -d ??.??.128.99 --dport 210 -j ACCEPT
        iptables -A OUTPUT -o eth0 -p tcp -d ??.??.128.99 --sport 210 -j ACCEPT

        iptables -A INPUT -i eth0 -p tcp -d ??.??.128.98 --dport 215 -j ACCEPT
        iptables -A OUTPUT -o eth0 -p tcp -d ??.??.128.98 --sport 215 -j ACCEPT
        iptables -A INPUT -i eth0 -p tcp -d ??.??.128.99 --dport 215 -j ACCEPT
        iptables -A OUTPUT -o eth0 -p tcp -d ??.??.128.99 --sport 215 -j ACCEPT

        iptables -A INPUT -i eth0 -p tcp -d ??.??.128.98 --dport 220 -j ACCEPT
        iptables -A OUTPUT -o eth0 -p tcp -d ??.??.128.98 --sport 220 -j ACCEPT
        iptables -A INPUT -i eth0 -p tcp -d ??.??.128.99 --dport 220 -j ACCEPT
        iptables -A OUTPUT -o eth0 -p tcp -d ??.??.128.99 --sport 220 -j ACCEPT

        iptables -A INPUT -i eth0 -p tcp -d ??.??.128.98 --dport 225 -j ACCEPT
        iptables -A OUTPUT -o eth0 -p tcp -d ??.??.128.98 --sport 225 -j ACCEPT
        iptables -A INPUT -i eth0 -p tcp -d ??.??.128.99 --dport 225 -j ACCEPT
        iptables -A OUTPUT -o eth0 -p tcp -d ??.??.128.99 --sport 225 -j ACCEPT

        iptables -A INPUT -i eth0 -p tcp -d ??.??.128.98 --dport 230 -j ACCEPT
        iptables -A OUTPUT -o eth0 -p tcp -d ??.??.128.98 --sport 230 -j ACCEPT
        iptables -A INPUT -i eth0 -p tcp -d ??.??.128.99 --dport 230 -j ACCEPT
        iptables -A OUTPUT -o eth0 -p tcp -d ??.??.128.99 --sport 230 -j ACCEPT

it really works like a charm, but is there any way to shorten this?
can i give multible ports and/or ips to iptables?

bye
 jonas