From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mike Wright Subject: Re: Specifying more than one IP address per rule Date: Mon, 19 Mar 2007 14:52:44 -0800 Message-ID: <45FF143C.9060307@mailinator.com> References: <45FF093F.10301@nitrosecurity.com> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <45FF093F.10301@nitrosecurity.com> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii"; format="flowed" To: Dan Purcell Cc: netfilter@lists.netfilter.org Dan Purcell wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Is there a way (such as an iptables match) that allows one to specify > more than one IP address for one rule? I have in mind something like > the multiport patch -- allowing the user to specify multiple tcp / udp > ports per rule. For example, I have the following ruleset that I would > like to convert into one rule: > > iptables -N BADGUYS > iptables -A BADGUYS -s 192.168.10.1 -j RETURN # 192.168.10.1 not bad > iptables -A BADGUYS -s 192.168.10.0/24 -j DROP > iptables -A BADGUYS -s 192.168.11.2 -j DROP > iptables -A BADGUYS -s 192.168.11.3 -j DROP > iptables -A BADGUYS -s 192.168.11.6 -j DROP > > I would like something like > > iptables -A BADGUYS -m multiip --srclist > [!192.168.10.1,192.168.10.0/24,192.168.11.2,192.168.11.3,192.168.11.6] > - -j DROP I've had very good success using the ipset patch to iptables. It allows you to use a single iptables rule to refer a named set of ips or nets, etc. The set can then be updated on the fly without having to mess with your iptables rules. hth, :m)