* can this be written as one rule ?
@ 2007-07-01 15:01 U. George
2007-07-01 15:04 ` Stephen Frost
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: U. George @ 2007-07-01 15:01 UTC (permalink / raw)
To: netfilter
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.124.176.0/20 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.124.32.0/20 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.127.64.0/17 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.128.94.0/24 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.130.126.128/26 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.132.194.0/24 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.139.164.0/24 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.139.198.0/24 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.141.9.0/24 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.142.125.0/24 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.142.3.128/25 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.145.21.128/25 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.146.201.0/24 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.152.32.0/24 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.153.78.0/24 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.153.98.0/24 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.155.196.0/25 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.158.66.128/25 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.16.0.0/13 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.224.0.0/12 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.24.0.0/14 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.254.15.0/24 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.32.0.0/14 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.36.0.0/16 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.36.64.0/18 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.51.0.0/16 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.54.208.0/20 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.54.224.0/20 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.55.128.0/20 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.55.144.0/20 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.55.160.0/20 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.55.64.0/20 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.68.0.0/14 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.88.32.0/20 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.88.64.0/20 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.96.0.0/15 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 122.0.128.0/17 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 122.100.48.0/20 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 122.169.0.0/19 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 122.169.100.0/23 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 122.199.106.0/22 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 122.199.90.0/23 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 122.2.0.0/15 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 122.202.128.0/17 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 122.254.128.0/17 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 122.32.0.0/12 -j DROP
> $IPTABLES -t nat -A PREROUTING -i $INET_I
And so on ?
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: can this be written as one rule ?
2007-07-01 15:01 can this be written as one rule ? U. George
@ 2007-07-01 15:04 ` Stephen Frost
2007-07-01 16:42 ` Mike Wright
2007-07-02 20:03 ` Clister
2 siblings, 0 replies; 4+ messages in thread
From: Stephen Frost @ 2007-07-01 15:04 UTC (permalink / raw)
To: U. George; +Cc: netfilter
[-- Attachment #1: Type: text/plain, Size: 359 bytes --]
* U. George (netbeans@gatworks.com) wrote:
>> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.124.176.0/20 -j DROP
>
> And so on ?
You can (ab)use ipt_recent to do it. There might be other ways but the
gist of it would be to build an ipt_recent table with those addresses at
boot and then reference it using an --rcheck or similar.
Enjoy,
Stephen
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: can this be written as one rule ?
2007-07-01 15:01 can this be written as one rule ? U. George
2007-07-01 15:04 ` Stephen Frost
@ 2007-07-01 16:42 ` Mike Wright
2007-07-02 20:03 ` Clister
2 siblings, 0 replies; 4+ messages in thread
From: Mike Wright @ 2007-07-01 16:42 UTC (permalink / raw)
To: netfilter
U. George wrote:
>> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.124.176.0/20 -j DROP
>> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.124.32.0/20 -j DROP
>> $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.127.64.0/17 -j DROP
<snip />
>> And so on ?
>
You could use ipset:
http://ipset.netfilter.org
Once a set of type nethash has been created and populated its usage is
very simple. e.g. To test whether a source|destination address is in a
nethash set named BADNETS use:
iptables -A INPUT -m set --set BADNETS src|dst -j NETHANDLER
Not sure if this extension is in the kernel yet but it's relatively easy
to add by following the instructions at their website.
:m)
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: can this be written as one rule ?
2007-07-01 15:01 can this be written as one rule ? U. George
2007-07-01 15:04 ` Stephen Frost
2007-07-01 16:42 ` Mike Wright
@ 2007-07-02 20:03 ` Clister
2 siblings, 0 replies; 4+ messages in thread
From: Clister @ 2007-07-02 20:03 UTC (permalink / raw)
To: netfilter
Did you try ipsets?
Just create a ipset populate it and then
i$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -m set --set $IPSET src -j DROP
et voila!!
Just try this:
http://ipset.netfilter.org/
or dig on the netfilter home page
Regards,
El Domingo, 1 de Julio de 2007 17:01, U. George escribió:
> > $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.124.176.0/20 -j DROP
> > $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.124.32.0/20 -j DROP
> > $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.127.64.0/17 -j DROP
> > $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.128.94.0/24 -j DROP
> > $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.130.126.128/26 -j
> > DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.132.194.0/24 -j
> > DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.139.164.0/24 -j
> > DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.139.198.0/24 -j
> > DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.141.9.0/24 -j
> > DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.142.125.0/24 -j
> > DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.142.3.128/25 -j
> > DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.145.21.128/25
> > -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.146.201.0/24
> > -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.152.32.0/24
> > -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.153.78.0/24
> > -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.153.98.0/24
> > -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 121.155.196.0/25
> > -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 121.158.66.128/25 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE
> > -s 121.16.0.0/13 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 121.224.0.0/12 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 121.24.0.0/14 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 121.254.15.0/24 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 121.32.0.0/14 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 121.36.0.0/16 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 121.36.64.0/18 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 121.51.0.0/16 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 121.54.208.0/20 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 121.54.224.0/20 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 121.55.128.0/20 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 121.55.144.0/20 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 121.55.160.0/20 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 121.55.64.0/20 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 121.68.0.0/14 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 121.88.32.0/20 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 121.88.64.0/20 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 121.96.0.0/15 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 122.0.128.0/17 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 122.100.48.0/20 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 122.169.0.0/19 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 122.169.100.0/23 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 122.199.106.0/22 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 122.199.90.0/23 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 122.2.0.0/15 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 122.202.128.0/17 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 122.254.128.0/17 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s
> > 122.32.0.0/12 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_I
>
> And so on ?
--
----------------------------
Universidad de Alcalá (UAH)
----------------------------
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2007-07-02 20:03 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-07-01 15:01 can this be written as one rule ? U. George
2007-07-01 15:04 ` Stephen Frost
2007-07-01 16:42 ` Mike Wright
2007-07-02 20:03 ` Clister
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.