Re: HELP : How to group IP addresses by refering to them as a single name ?

[Joel Newkirk <netfilter@newkirk.us>]

On Thursday 19 September 2002 03:33 pm, Antony Stone wrote:
> On Thursday 19 September 2002 7:00 pm, Alok Shukla wrote:
> > Let me say if i am able to sort out the lab in the
> > accordance that i start my ip settings of lab2
> >  like 192.168.9.1-63 for lab 1
> >
> > and next 64 for lab 2 , would that help and how ?
>
> I think it would help a lot, yes.   I would recommend putting machines into
> three groups:
> 1. User machines in Lab1
> 2. User machines in Lab2
> 3. System machines such as servers, routers, etc.
>
> Separate the IP addresses for each of these three groups so that you can
> specify a single group with an easy netmask.

[snip excellent mask explanation, insert quick'n'dirty script excerpts]

# define convenient symbols for the IPTables rules
#
IPTABLES=/sbin/iptables
# everything from 0.0 to 0.63 is administrator territory
SERVERS="192.168.0.0/26"
# Lab 1 from 0.64 to 0.127
LAB1="192.168.0.64/26"
#Lab2 from 0.128 to 0.191
LAB2="192.168.0.128/26"
#0.192 to 0.255 unassigned for now
FUTUREEXPANSION="192.168.0.192/26"
#
$IPTABLES -t nat -A POSTROUTING -s $LAB1 -j MASQUERADE
# et cetera

The four address ranges can of course be used in any order, this one means reconfiguring 54 machines, changing the server addresses would mean reconfiguring all machines.  (Of course, you'll use student labor anyway... ;^)

You can also create simple scripts to run either manually or on schedule, that do nothing but -A(dd) and -D(elete) the rule for a given lab's address range.
like:

#!/bin/sh
# lab1off
/sbin/iptables -t nat -D -s 192.168.0.64/26 -j MASQUERADE