* Specifying more than one IP address per rule
@ 2007-03-19 22:05 Dan Purcell
2007-03-19 22:52 ` Mike Wright
0 siblings, 1 reply; 4+ messages in thread
From: Dan Purcell @ 2007-03-19 22:05 UTC (permalink / raw)
To: netfilter
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Is there a way (such as an iptables match) that allows one to specify
more than one IP address for one rule? I have in mind something like
the multiport patch -- allowing the user to specify multiple tcp / udp
ports per rule. For example, I have the following ruleset that I would
like to convert into one rule:
iptables -N BADGUYS
iptables -A BADGUYS -s 192.168.10.1 -j RETURN # 192.168.10.1 not bad
iptables -A BADGUYS -s 192.168.10.0/24 -j DROP
iptables -A BADGUYS -s 192.168.11.2 -j DROP
iptables -A BADGUYS -s 192.168.11.3 -j DROP
iptables -A BADGUYS -s 192.168.11.6 -j DROP
I would like something like
iptables -A BADGUYS -m multiip --srclist
[!192.168.10.1,192.168.10.0/24,192.168.11.2,192.168.11.3,192.168.11.6]
- -j DROP
- --
- --------------------------------------------------------------
Dan Purcell, Software Engineer dpurcell@nitrosecurity.com
NitroSecurity, Inc. (208) 552-5332
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFF/wk/Tqu8TzII/vURAnu7AKCGQrWo5WQL9NqQxnq+pcR+GFCY7gCg5ul9
hXek3Rza6Hgtd/xslOtqryY=
=kwdw
-----END PGP SIGNATURE-----
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Specifying more than one IP address per rule
2007-03-19 22:05 Specifying more than one IP address per rule Dan Purcell
@ 2007-03-19 22:52 ` Mike Wright
2007-03-19 22:55 ` Dan Purcell
0 siblings, 1 reply; 4+ messages in thread
From: Mike Wright @ 2007-03-19 22:52 UTC (permalink / raw)
To: Dan Purcell; +Cc: netfilter
Dan Purcell wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Is there a way (such as an iptables match) that allows one to specify
> more than one IP address for one rule? I have in mind something like
> the multiport patch -- allowing the user to specify multiple tcp / udp
> ports per rule. For example, I have the following ruleset that I would
> like to convert into one rule:
>
> iptables -N BADGUYS
> iptables -A BADGUYS -s 192.168.10.1 -j RETURN # 192.168.10.1 not bad
> iptables -A BADGUYS -s 192.168.10.0/24 -j DROP
> iptables -A BADGUYS -s 192.168.11.2 -j DROP
> iptables -A BADGUYS -s 192.168.11.3 -j DROP
> iptables -A BADGUYS -s 192.168.11.6 -j DROP
>
> I would like something like
>
> iptables -A BADGUYS -m multiip --srclist
> [!192.168.10.1,192.168.10.0/24,192.168.11.2,192.168.11.3,192.168.11.6]
> - -j DROP
I've had very good success using the ipset patch to iptables. It allows
you to use a single iptables rule to refer a named set of ips or nets,
etc. The set can then be updated on the fly without having to mess with
your iptables rules.
hth, :m)
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Specifying more than one IP address per rule
2007-03-19 22:52 ` Mike Wright
@ 2007-03-19 22:55 ` Dan Purcell
2007-03-19 23:14 ` Mike Wright
0 siblings, 1 reply; 4+ messages in thread
From: Dan Purcell @ 2007-03-19 22:55 UTC (permalink / raw)
To: Mike Wright; +Cc: netfilter
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Do you have to use a userspace tool to set the sets of ip addresses?
What is it called? Where can I get it?
- -Dan
Mike Wright wrote:
> Dan Purcell wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Is there a way (such as an iptables match) that allows one to specify
>> more than one IP address for one rule? I have in mind something like
>> the multiport patch -- allowing the user to specify multiple tcp / udp
>> ports per rule. For example, I have the following ruleset that I would
>> like to convert into one rule:
>>
>> iptables -N BADGUYS
>> iptables -A BADGUYS -s 192.168.10.1 -j RETURN # 192.168.10.1 not bad
>> iptables -A BADGUYS -s 192.168.10.0/24 -j DROP
>> iptables -A BADGUYS -s 192.168.11.2 -j DROP
>> iptables -A BADGUYS -s 192.168.11.3 -j DROP
>> iptables -A BADGUYS -s 192.168.11.6 -j DROP
>>
>> I would like something like
>>
>> iptables -A BADGUYS -m multiip --srclist
>> [!192.168.10.1,192.168.10.0/24,192.168.11.2,192.168.11.3,192.168.11.6]
>> - -j DROP
>
> I've had very good success using the ipset patch to iptables. It allows
> you to use a single iptables rule to refer a named set of ips or nets,
> etc. The set can then be updated on the fly without having to mess with
> your iptables rules.
>
> hth, :m)
- --
- --------------------------------------------------------------
Dan Purcell, Software Engineer dpurcell@nitrosecurity.com
NitroSecurity, Inc. (208) 552-5332
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFF/xT0Tqu8TzII/vURAswuAKCtvI69OGwoJ/R6T7yzfENzfFNYFACg3/aM
m+kLwX1TifdIKbKnTeMD7aw=
=As7F
-----END PGP SIGNATURE-----
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Specifying more than one IP address per rule
2007-03-19 22:55 ` Dan Purcell
@ 2007-03-19 23:14 ` Mike Wright
0 siblings, 0 replies; 4+ messages in thread
From: Mike Wright @ 2007-03-19 23:14 UTC (permalink / raw)
To: Dan Purcell; +Cc: netfilter
Dan Purcell wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Do you have to use a userspace tool to set the sets of ip addresses?
> What is it called? Where can I get it?
>
The ipset package provides both a kernel patch and a utility
conveniently named ipset.
http://ipset.netfilter.org
:m)
> - -Dan
>
> Mike Wright wrote:
>
>>Dan Purcell wrote:
>>
>>>-----BEGIN PGP SIGNED MESSAGE-----
>>>Hash: SHA1
>>>
>>>Is there a way (such as an iptables match) that allows one to specify
>>>more than one IP address for one rule? I have in mind something like
>>>the multiport patch -- allowing the user to specify multiple tcp / udp
>>>ports per rule. For example, I have the following ruleset that I would
>>>like to convert into one rule:
>>>
>>>iptables -N BADGUYS
>>>iptables -A BADGUYS -s 192.168.10.1 -j RETURN # 192.168.10.1 not bad
>>>iptables -A BADGUYS -s 192.168.10.0/24 -j DROP
>>>iptables -A BADGUYS -s 192.168.11.2 -j DROP
>>>iptables -A BADGUYS -s 192.168.11.3 -j DROP
>>>iptables -A BADGUYS -s 192.168.11.6 -j DROP
>>>
>>>I would like something like
>>>
>>>iptables -A BADGUYS -m multiip --srclist
>>>[!192.168.10.1,192.168.10.0/24,192.168.11.2,192.168.11.3,192.168.11.6]
>>>- -j DROP
>>
>>I've had very good success using the ipset patch to iptables. It allows
>>you to use a single iptables rule to refer a named set of ips or nets,
>>etc. The set can then be updated on the fly without having to mess with
>>your iptables rules.
>>
>>hth, :m)
>
>
> - --
>
> - --------------------------------------------------------------
> Dan Purcell, Software Engineer dpurcell@nitrosecurity.com
> NitroSecurity, Inc. (208) 552-5332
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.6 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iD8DBQFF/xT0Tqu8TzII/vURAswuAKCtvI69OGwoJ/R6T7yzfENzfFNYFACg3/aM
> m+kLwX1TifdIKbKnTeMD7aw=
> =As7F
> -----END PGP SIGNATURE-----
>
>
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2007-03-19 23:14 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-03-19 22:05 Specifying more than one IP address per rule Dan Purcell
2007-03-19 22:52 ` Mike Wright
2007-03-19 22:55 ` Dan Purcell
2007-03-19 23:14 ` Mike Wright
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.