Defining ip range in a rule

Defining ip range in a rule

[McDouglas]

Hi,

I'd like to ask how to define an ip address range in a rule. I don't 
mean using subnet mask but rather for example making a rule which will 
block port 110 for the 10.10.2.50-10.10.2.150 ip range.

Thank you.

-- 
Tisztelettel:

Gregorics Tamás

Szervízmunkatárs
M&M Computer Kft.
7623 Pécs, Mártírok u.42.
Tel.: +36-72/516-511
Fax: +36-72/516-529
Mobil: +36-30-943-6784
e-mail: tamas.gregorics@mmcomputer.hu

http://www.mmcomputer.hu 

Re: Defining ip range in a rule

[John A. Sullivan III]

On Mon, 2006-03-20 at 12:22 +0100, McDouglas wrote:
> Hi,
> 
> I'd like to ask how to define an ip address range in a rule. I don't 
> mean using subnet mask but rather for example making a rule which will 
> block port 110 for the 10.10.2.50-10.10.2.150 ip range.
> 
> Thank you.
The iprange match is in most newer kernels.  If it is missing in yours,
you may need to patch.  You may also need to check to see if it is
included in activated in your kernel.

The man page will have more information but the syntax is:

iptables -A FORWARD -m iprange --[src|dst]-range x.x.x.x-y.y.y.y

Or at least so I recall.  Good luck - John
-- 
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan@opensourcedevel.com

If you would like to participate in the development of an open source
enterprise class network security management system, please visit
http://iscs.sourceforge.net

Re: Defining ip range in a rule

[Hardik Dalwadi]

Hi McDouglas,

On Monday 20 March 2006 04:52 PM, McDouglas wrote:
> Hi,
> 
> I'd like to ask how to define an ip address range in a rule. I don't 
> mean using subnet mask but rather for example making a rule which will 
> block port 110 for the 10.10.2.50-10.10.2.150 ip range.

If your kernel is compiled with CONFIG_IP_NF_MATCH_IPRANGE=y
then check below Example.

iptables -I PREROUTING -t nat -m iprange --src-range
			       ^^^^^^^^^^^^^^^^^^^^^^	
10.10.2.50-10.10.2.150 -p tcp --dport 80 -j DNAT --to
^^^^^^^^^^^^^^^^^^^^^^^^^
10.10.2.1:3128


Hardik Dalwadi.

Re: Defining ip range in a rule

[Askar Ali]

>
> I'd like to ask how to define an ip address range in a rule. I don't
> mean using subnet mask but rather for example making a rule which will
> block port 110 for the 10.10.2.50-10.10.2.150 ip range.
>
for i in IpListDelimitedwithSpace
do
iptables -A INPUT -p tcp --dport 110 -s $i -J DROP

done

Askar.