How to Find the Subnet Range of an ISP with whois

There are times when you want to know the subnet range of an ISP or similar.

For example, when you want to allow SSH only from your home subnet on an external server such as AWS or a VPS, and therefore want to know the range of the dynamic IP in your home environment.

You can look it up with whois, which is a surprisingly simple method (well, the web based JPNIC WHOIS Gateway (in Japanese) is simple too…)

$ whois 211.127.83.xx
Network Information: [ネットワーク情報]
a. [IPネットワークアドレス]     211.127.0.0/17
b. [ネットワーク名]             ODN
f. [組織名]                     オープンデータネットワーク(日本テレコム株式会社)
g. [Organization]               Open Data Network(JAPAN TELECOM CO.,LTD.)
....

In my home environment I use ODN, and the subnet range (211.127.0.0/17) is shown in the IP network address

When you want to allow access from home on an external server, you can simply permit this range.
If you want to restrict more than just ssh, you can write it into iptables, tcp-wrapper, hosts.allow, fail2ban, sshd_config, PAM and so on to apply the restriction.

Note, however, that this also means allowing others on the same subnet, so some care is needed. Large ISPs in particular have wide subnet ranges, so it is desirable to keep it as narrow as possible.

Also, large ISPs may have a great many subnets, so if you want to know the details, try using the JPNIC WHOIS Gateway (in Japanese) (incidentally, for ODN this time the upstream was SoftBank, and there were close to 70 assigned subnets)

See also