There seems to be a lot of confusion with this, so I’m going to make this quick any easy. IPtables is a stateful firewall tht is both powerful and efficent. That being said, let’s look at how to restrict a port or service to a specific IP or range of IPs. Entering the following at root will allow SSH connections from the first two locations and drop them from everywhere else:
iptables -I INPUT -p tcp -m tcp -s 192.168.15.16 –dport 22 -j ACCEPT
iptables -I INPUT -p tcp -m tcp -s 192.168.15.254/26 –dport 22 -j ACCEPT
iptables -I INPUT -p tcp -m tcp -s 0.0.0.0/0 –dport 22 -j DROP
Remember, if you want this configuration to survive reboots, you will need to use the command iptables-save. Red hat-based systems will store the configuration in the files /etc/sysconfig/iptables.
If you would like to edit this file directly, use the following:
-A INPUT -p tcp -m tcp -s 192.168.15.16 –dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp -s 192.168.15.254/26 –dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp -s 0.0.0.0/0 –dport 22 -j DROP
Remember, IPtables like most hardware firewalls, uses stateful packet inspection. It will read the rules in order from top to bottom. This is why we put all the allowed networks first and then put in a blanket deny all (0.0.0.0/0). You can enter hosts into IPtables using any of the following formats:
IP address: ex. 192.168.15.16
DNS name: ex. skullbox.net
CIDR: ex. 192.168.15.254/26
Thanks to http://blog.erikrodriguez.net/?title=iptables-open-port-from-location&more=1&c=1&tb=1&pb=1