restriction for some hosts.

restriction for some hosts.

[BusyBoy]

Hello,

I need some help in iptables  and I want to allow   some  hosts
to ping to my box and rest of the network or internet blocked.

like I have linux box 192.168.0.1 (Gateway) and 192.168.0.2 to
192.168.0.100 are clients.

I want only

192.168.0.5
192.168.0.10
192.168.0.55

to be allowed to ping my linux box 192.168.0.1 and internet hosts  but
rest of the machines should be  blocked.( not being able  to ping and
traceroute )

any help in this reagrd will be highly appriciated.


-- 
Nasir Mahmood
Systems + Network Admin.
Asia Net.

Re: restriction for some hosts.

[Jason Opperisano]

On Thu, Dec 02, 2004 at 03:20:10AM -0800, BusyBoy wrote:
> Hello,
> 
> I need some help in iptables  and I want to allow   some  hosts
> to ping to my box and rest of the network or internet blocked.
> 
> like I have linux box 192.168.0.1 (Gateway) and 192.168.0.2 to
> 192.168.0.100 are clients.
> 
> I want only
> 
> 192.168.0.5
> 192.168.0.10
> 192.168.0.55
> 
> to be allowed to ping my linux box 192.168.0.1 and internet hosts  but
> rest of the machines should be  blocked.( not being able  to ping and
> traceroute )
> 
> any help in this reagrd will be highly appriciated.

traceroute can use either ICMP Echo Requests with TTL's incrementing
from 1, or UDP packets starting at UDP port 33434.  these rules
accommodate both types:

  PINGERS="192.168.0.5 192.168.0.10 192.168.0.55"

  # allow specific hosts to ping fw and traceroute via UDP
  for i in $PINGERS; do
    iptables -A INPUT -p icmp --icmp-type echo-request -s $i -j ACCEPT
    iptables -A INPUT -p udp --dport 33434:33534 -s $i -j ACCEPT
  done

  # allow specific hosts to ping internet and traceroute via UDP
  for i in $PINGERS; do
    iptables -A FORWARD -p icmp --icmp-type echo-request -s $i -j ACCEPT
    iptables -A FORWARD -p udp --dport 33434:33534 -s $i -j ACCEPT
  done

i'm assuming you utilize "-P DROP" on your filter chains, and "-m state
--state ESTABLISHED,RELATED -j ACCEPT" at the top of each filter chain.

-j

--
"Do you want to change your name to Homer Junior? The kids can call
 you Hoju!"
        --The Simpsons