can i have boolean OR between multiple addresses in iptables expression?

can i have boolean OR between multiple addresses in iptables expression?

[prosolutions]

for example i would like to have a rule with -s !127.0.0.1 OR !172.16.0.0/24   

how can this be done?


-- 
.. Synthetic a-priori judgements should not be patentable ..

RE: can i have boolean OR between multiple addresses in iptablesexpression?

[Pablo Sanchez]

 

> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org 
> [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of 
> prosolutions@gmx.net
> Sent: Thursday, June 08, 2006 8:33 PM
> To: netfilter@lists.netfilter.org
> Subject: can i have boolean OR between multiple addresses in 
> iptablesexpression?
> 
> 
> 
> for example i would like to have a rule with -s !127.0.0.1 OR 
> !172.16.0.0/24   

I believe you can't.  What I've done is simply create several rules with the
predicate slightly different in each to accomplish an OR.  If you'd like to
make it obvious, you can create a new chain and place your different rules
there.
---
Pablo Sanchez - Blueoak Database Engineering, Inc
Ph:    819.459.1926          Toll free:  888.459.1926
Cell:  819.918.9731                Pgr:  pablo_p@blueoakdb.com
Fax:   603.720.7723 (US)           Fax:  514.371.1255 (Canada)

Re: can i have boolean OR between multiple addresses in iptables expression?

[Pascal Hambourg]

Hello,

Pablo Sanchez a écrit :
>>
>>for example i would like to have a rule with -s !127.0.0.1 OR 
>>!172.16.0.0/24   
> 
> I believe you can't.  What I've done is simply create several rules with the
> predicate slightly different in each to accomplish an OR.  If you'd like to
> make it obvious, you can create a new chain and place your different rules
> there.

I think that using a user defined chain is not only a matter of 
obviousness, in some case the result may be different from using two 
separate rules. For example :

iptables -A INPUT -s 127.0.0.1 -m limit -j ACCEPT
iptables -A INPUT -s 172.16.0.0/24 -m limit -j ACCEPT

and :

iptables -A INPUT -s 127.0.0.1 -j user_chain
iptables -A INPUT -s 172.16.0.0/24 -j user_chain
iptables -A user_chain -m limit -j ACCEPT

behave differently because, if I understand correctly, each 'limit' 
match has its own counters and timers. Am I right ?

RE: can i have boolean OR between multiple addresses in iptables expression?

[Pablo Sanchez]

 

> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org 
> [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of 
> Pascal Hambourg
> Sent: Saturday, June 10, 2006 3:34 AM
> To: netfilter@lists.netfilter.org
> Subject: Re: can i have boolean OR between multiple addresses 
> in iptables expression?
> 
> I think that using a user defined chain is not only a matter of 
> obviousness, in some case the result may be different from using two 
> separate rules. For example :
> 
> iptables -A INPUT -s 127.0.0.1 -m limit -j ACCEPT
> iptables -A INPUT -s 172.16.0.0/24 -m limit -j ACCEPT
> 
> and :
> 
> iptables -A INPUT -s 127.0.0.1 -j user_chain
> iptables -A INPUT -s 172.16.0.0/24 -j user_chain
> iptables -A user_chain -m limit -j ACCEPT
> 
> behave differently because, if I understand correctly, each 'limit' 
> match has its own counters and timers. Am I right ?

Absolutely.  You do have to be certain to 'play computer' correctly when you
write the rules.  Know that each rule is an AND and apply OR's correctly
with judicious use of the -j ACCEPT target.
---
Pablo Sanchez - Blueoak Database Engineering, Inc
Ph:    819.459.1926          Toll free:  888.459.1926
Cell:  819.918.9731                Pgr:  pablo_p@blueoakdb.com
Fax:   603.720.7723 (US)           Fax:  514.371.1255 (Canada)