What's the best way to block these IP's?

What's the best way to block these IP's?

[Netfilter]

What's the best way to block these IP's?


:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p tcp -s 61.0.0.0/32 -i eth1 -j  DROP
-A INPUT -p tcp -s 66.0.0.0/32 -i eth1 -j  DROP
-A INPUT -p tcp -s 80.0.0.0/32 -i eth1 -j  DROP
-A INPUT -p tcp -s 82.0.0.0/32 -i eth1 -j  DROP
-A INPUT -p tcp -s 211.0.0.0/32 -i eth1 -j DROP
-A INPUT -p tcp -s 213.0.0.0/32 -i eth1 -j DROP

or

-A INPUT -p tcp -s 218.0.0.0 -i eth1 -j DROP
-A INPUT -p tcp -s 219.0.0.0 -i eth1 -j DROP
-A INPUT -p tcp -s 219.0.0.0 -i eth1 -j DROP

thanks

What's the best way to block these IP's?

[Netfilter]

What's the best way to block these IP's?


:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p tcp -s 61.0.0.0/32 -i eth1 -j  DROP
-A INPUT -p tcp -s 66.0.0.0/32 -i eth1 -j  DROP
-A INPUT -p tcp -s 80.0.0.0/32 -i eth1 -j  DROP
-A INPUT -p tcp -s 82.0.0.0/32 -i eth1 -j  DROP
-A INPUT -p tcp -s 211.0.0.0/32 -i eth1 -j DROP
-A INPUT -p tcp -s 213.0.0.0/32 -i eth1 -j DROP

or

-A INPUT -p tcp -s 218.0.0.0 -i eth1 -j DROP
-A INPUT -p tcp -s 219.0.0.0 -i eth1 -j DROP
-A INPUT -p tcp -s 219.0.0.0 -i eth1 -j DROP

thanks

Re: What's the best way to block these IP's?

[/dev/rob0]

On Saturday 18 June 2005 11:46, Netfilter wrote:
> What's the best way to block these IP's?

I'm not sure what your question is. I see a few main possibilities
about which you might be asking. I'll address those.

> -A INPUT -p tcp -s 213.0.0.0/32 -i eth1 -j DROP
>
> or
>
> -A INPUT -p tcp -s 218.0.0.0 -i eth1 -j DROP

Maybe you don't understand CIDR notation, and thus don't know what
these do. A /32 netmask means "this IP only" in English. 32 bits of 
netmask is 255.255.255.255. Both forms are the same!

If you want to block all IP's starting with 213 or 218, those won't do 
it. You would need to use /8 or smaller. 218.0.0.0/8 is 218.0.0.0 
through 218.255.255.255; 218.0.0.0/7 is 218.0.0.0 through 
219.255.255.255. Rusty's Networking Concepts HOWTO might help.

Generally the best strategy for firewalling is to choose what to allow 
and let everything else hit a DROP or REJECT policy or rule. Here the 
Packet Filtering HOWTO has examples which might help. Note as well that 
all your examples are only limiting TCP traffic, and only if coming in 
your eth1 interface.

Furthermore there are common misunderstandings concerning the role of 
INPUT as opposed to FORWARD. If you're wanting to block traffic from or 
to NAT users, your INPUT rules will not do it. Again this is explained 
in the Packet Filtering HOWTO.

When I have common rules I want called from both INPUT and FORWARD, I 
use a new chain ...
# iptables -N Common
# iptables -vA Common -s 218.0.0.0/7 -j DROP
[ ... other rules as wanted ... ]
# iptables -vA INPUT -j Common
# iptables -vA FORWARD -j Common
You can of course limit the type of traffic sent to the chain with 
matches on the calling rule.

HTH, and if not you, HTH someone else.
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header

Re: What's the best way to block these IP's?

[Netfilter]

Thanks fo the reply... I noticed the error of the "/32" CIDR right after I 
sent it.
Brain fart on my part.
I just wanted to know if
 218.0.0.0 without the" /*"  would work. (blocking the whole 218.0.0.0 
block)




From: "/dev/rob0" <rob0@gmx.co.uk>
To: <netfilter@lists.netfilter.org>
Sent: Saturday, June 18, 2005 12:46 PM
Subject: Re: What's the best way to block these IP's?


> On Saturday 18 June 2005 11:46, Netfilter wrote:
>> What's the best way to block these IP's?
>
> I'm not sure what your question is. I see a few main possibilities
> about which you might be asking. I'll address those.
>
>> -A INPUT -p tcp -s 213.0.0.0/32 -i eth1 -j DROP
>>
>> or
>>
>> -A INPUT -p tcp -s 218.0.0.0 -i eth1 -j DROP
>
> Maybe you don't understand CIDR notation, and thus don't know what
> these do. A /32 netmask means "this IP only" in English. 32 bits of
> netmask is 255.255.255.255. Both forms are the same!
>
> If you want to block all IP's starting with 213 or 218, those won't do
> it. You would need to use /8 or smaller. 218.0.0.0/8 is 218.0.0.0
> through 218.255.255.255; 218.0.0.0/7 is 218.0.0.0 through
> 219.255.255.255. Rusty's Networking Concepts HOWTO might help.
>
> Generally the best strategy for firewalling is to choose what to allow
> and let everything else hit a DROP or REJECT policy or rule. Here the
> Packet Filtering HOWTO has examples which might help. Note as well that
> all your examples are only limiting TCP traffic, and only if coming in
> your eth1 interface.
>
> Furthermore there are common misunderstandings concerning the role of
> INPUT as opposed to FORWARD. If you're wanting to block traffic from or
> to NAT users, your INPUT rules will not do it. Again this is explained
> in the Packet Filtering HOWTO.
>
> When I have common rules I want called from both INPUT and FORWARD, I
> use a new chain ...
> # iptables -N Common
> # iptables -vA Common -s 218.0.0.0/7 -j DROP
> [ ... other rules as wanted ... ]
> # iptables -vA INPUT -j Common
> # iptables -vA FORWARD -j Common
> You can of course limit the type of traffic sent to the chain with
> matches on the calling rule.
>
> HTH, and if not you, HTH someone else.
> -- 
>    mail to this address is discarded unless "/dev/rob0"
>    or "not-spam" is in Subject: header 

Re: What's the best way to block these IP's?

[Cedric Blancher]

Le samedi 18 juin 2005 à 11:46 -0500, Netfilter a écrit : 
> What's the best way to block these IP's?

See Netfilter IP sets :

	http://people.netfilter.org/kadlec/ipset/


-- 
http://sid.rstack.org/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

Re: What's the best way to block these IP's?

[Jason Opperisano]

On Sat, Jun 18, 2005 at 01:02:31PM -0500, Netfilter wrote:
> Thanks fo the reply... I noticed the error of the "/32" CIDR right after I 
> sent it.
> Brain fart on my part.
> I just wanted to know if
> 218.0.0.0 without the" /*"  would work. (blocking the whole 218.0.0.0 
> block)

the default prefix length when none is specified is /32, so no...using
218.0.0.0 in a rule is not the same as 218.0.0.0/8; it is the same as
218.0.0.0/32.

<need coffee>
 would it really have been such a daunting task to just add a rule using
 both notations and compared the results?
</need coffee>

-j

--
"Peter: Now, I know you're a feminist, and I think that's adorable, but
 this is grown-up time and I'm the man."
        --Family Guy