HELP : How to group IP addresses by refering to them as a single name ?

HELP : How to group IP addresses by refering to them as a single name ?

[Alok Shukla]

HI,

I run a College Laboratory with two rooms for the
whole labaratory
I have given a static IP for each of the computers
from 192.168.0.1 to 192.168.0.254.

1. My Lab 1 has IP from 192.198.0.11 to 192.168.0.50
and Lab 2 has IP from 192.168.0.51 to 192.168.0.90

2. I run a Redhat Linux 7.3 Server that acts as a
masquerading server, DNS Server and a Web Server.Its
IP is 192.168.0.1

3. I also have Windows NT Server for running a domain
over the whole network.Its IP is 192.168.0.2

4. My each of the client machine has Windows XP
Professional running which acts as a CLient for WIN NT
Domain.Each computer has gateway setting as for Red
Hat Linux 7.3 machine.

5. My Iptables scripts allows everbody to access the
net through following command:-

iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -d
any/0 -j MASQUERADE

Now my problem :-

I want to have a set of rules so that i can group Lab
1 computers in one group and Lab 2 computers in
another group. In this I want to able to shutdown the
Internet facility by stopping its masquerading as a
whole by refering as a single name.

Like something like :-

iptables -t nat -D POSTROUTING -s "LAB1" -d any/0 -J
MASQUERADE

or rather

iptables -t nat -D POSTROUTING -s 192.168.0.11-50  -d
any/0 -J MASQUERADE

Is short i want to create groups and i want to
administer network access by refering to group of
computers rather than their respective IP addresses..
SOmething like name addressing or rather multicasting 
etc...or whatever

Alok Shukla

__________________________________________________
Do you Yahoo!?
New DSL Internet Access from SBC & Yahoo!
http://sbc.yahoo.com

Re: HELP : How to group IP addresses by refering to them as a single name ?

[Rohan Almeida]

Alok Shukla <alokshukla@yahoo.com> thus wrote:

> iptables -t nat -D POSTROUTING -s 192.168.0.11-50  -d
> any/0 -J MASQUERADE

Well, I don't think the above option is available
with the current version of iptables
Why don't u create subnets.

for eg. for 8 ips from 192.168.0.0 - 192.168.0.7
u can use "-s 192.168.0.7/29"

similarly for 192.168.0.8 - 192.168.0.15
u can use "-s 192.168.0.15/29"

Just a suggestion :-)
Might not be the most appropriate

But, i would normally create some shell or perl
scripts to manipulate the ips

--
arc_of_descent

Re: HELP : How to group IP addresses by refering to them as a single name ?

[Antony Stone]

On Thursday 19 September 2002 8:45 am, Alok Shukla wrote:

> HI,
>
> I run a College Laboratory with two rooms for the
> whole labaratory
> I have given a static IP for each of the computers
> from 192.168.0.1 to 192.168.0.254.
>
> 1. My Lab 1 has IP from 192.198.0.11 to 192.168.0.50
> and Lab 2 has IP from 192.168.0.51 to 192.168.0.90
>
> I want to have a set of rules so that i can group Lab
> 1 computers in one group and Lab 2 computers in
> another group. In this I want to able to shutdown the
> Internet facility by stopping its masquerading as a
> whole by refering as a single name.
>
> Like something like :-
>
> iptables -t nat -D POSTROUTING -s "LAB1" -d any/0 -J
> MASQUERADE

You can't use names like this in rules, however you might be able to achieve 
something almost as effective by creating two user-defined chains forthe two 
groups of machines, and then putting your rules to apply to each group in the 
appropriate chain ?

It's a pity your two groups do not split on a neat IP address boundary (maybe 
you could fix this sometime in the future, for example by putting all LAB1 
machines in the range 192.168.0.0-63, all LAB2 machines in the range 
192.168.0.64-127, and all 'general net admin' machines (DNS, NT server etc) 
above 192.168.0.128 ?), however you could try splitting them up as follows:

# create a user-defined chain called LAB1
iptables -N LAB1
# add rules to match machines *not* in LAB1 and return immediately
iptables -A LAB1 -s 192.168.0.64/26 -j RETURN
iptables -A LAB1 -s 192.168.0.56/29 -j RETURN
iptables -A LAB1 -s 192.168.0.52/30 -j RETURN
iptables -A LAB1 -s 192.168.0.50/31 -j RETURN
# now any further rules we put in chain LAB1 will only apply to those machines

# create user-defined LAB2 chain
iptables -N LAB2
# add some rules to eliminate non-LAB2 machines
iptables -A LAB2 -s 192.168.0.0/27 -j RETURN
iptables -A LAB2 -s 192.168.0.32/28 -j RETURN
iptables -A LAB2 -s 192.168.0.48/31 -j RETURN
# now any further rules we put in chain LAB2 will only apply to those machines

I suggest using these chains as follows:

1. Add rules as necessary to the above chains to ACCEPT the traffic you want
2. Put a rule at the end of both LAB1 and LAB2 chains to DROP any other 
traffic
3. Call both rules near the start of your FORWARD chain and then add any 
other rules for non-(LAB1 or LAB2) machines:

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -j LAB1
iptables -A FORWARD -j LAB2
iptables -A FORWARD -s $extDNS -p tcp --dport 53 -j ACCEPT
iptables -A FORWARD -s $extDNS -p udp --dport 53 -j ACCEPT

This would allow servers not in the LAB1 or LAB2 ranges to access an external 
DNS server, for example.

If you want any help understanding how I created the range matches in the two 
chains above, let me know and I'll explain in more detail.

Hopw this helps,

Antony.

-- 

This is not a rehearsal.
This is Real Life.

Re: HELP : How to group IP addresses by refering to them as a single name ?

[Alok Shukla]

Let me say if i am able to sort out the lab in the
accordance that i start my ip settings of lab2 
 like 192.168.9.1-63 for lab 1

and next 64 for lab 2 , would that help and how ?

but i still think that it still bounds me ..

But i would request you to explain in detail as you
said

Alok SHukla


--- Antony Stone <Antony@Soft-Solutions.co.uk> wrote:
> On Thursday 19 September 2002 8:45 am, Alok Shukla
> wrote:
> 
> > HI,
> >
> > I run a College Laboratory with two rooms for the
> > whole labaratory
> > I have given a static IP for each of the computers
> > from 192.168.0.1 to 192.168.0.254.
> >
> > 1. My Lab 1 has IP from 192.198.0.11 to
> 192.168.0.50
> > and Lab 2 has IP from 192.168.0.51 to 192.168.0.90
> >
> > I want to have a set of rules so that i can group
> Lab
> > 1 computers in one group and Lab 2 computers in
> > another group. In this I want to able to shutdown
> the
> > Internet facility by stopping its masquerading as
> a
> > whole by refering as a single name.
> >
> > Like something like :-
> >
> > iptables -t nat -D POSTROUTING -s "LAB1" -d any/0
> -J
> > MASQUERADE
> 
> You can't use names like this in rules, however you
> might be able to achieve 
> something almost as effective by creating two
> user-defined chains forthe two 
> groups of machines, and then putting your rules to
> apply to each group in the 
> appropriate chain ?
> 
> It's a pity your two groups do not split on a neat
> IP address boundary (maybe 
> you could fix this sometime in the future, for
> example by putting all LAB1 
> machines in the range 192.168.0.0-63, all LAB2
> machines in the range 
> 192.168.0.64-127, and all 'general net admin'
> machines (DNS, NT server etc) 
> above 192.168.0.128 ?), however you could try
> splitting them up as follows:
> 
> # create a user-defined chain called LAB1
> iptables -N LAB1
> # add rules to match machines *not* in LAB1 and
> return immediately
> iptables -A LAB1 -s 192.168.0.64/26 -j RETURN
> iptables -A LAB1 -s 192.168.0.56/29 -j RETURN
> iptables -A LAB1 -s 192.168.0.52/30 -j RETURN
> iptables -A LAB1 -s 192.168.0.50/31 -j RETURN
> # now any further rules we put in chain LAB1 will
> only apply to those machines
> 
> # create user-defined LAB2 chain
> iptables -N LAB2
> # add some rules to eliminate non-LAB2 machines
> iptables -A LAB2 -s 192.168.0.0/27 -j RETURN
> iptables -A LAB2 -s 192.168.0.32/28 -j RETURN
> iptables -A LAB2 -s 192.168.0.48/31 -j RETURN
> # now any further rules we put in chain LAB2 will
> only apply to those machines
> 
> I suggest using these chains as follows:
> 
> 1. Add rules as necessary to the above chains to
> ACCEPT the traffic you want
> 2. Put a rule at the end of both LAB1 and LAB2
> chains to DROP any other 
> traffic
> 3. Call both rules near the start of your FORWARD
> chain and then add any 
> other rules for non-(LAB1 or LAB2) machines:
> 
> iptables -A FORWARD -m state --state
> ESTABLISHED,RELATED -j ACCEPT
> iptables -A FORWARD -j LAB1
> iptables -A FORWARD -j LAB2
> iptables -A FORWARD -s $extDNS -p tcp --dport 53 -j
> ACCEPT
> iptables -A FORWARD -s $extDNS -p udp --dport 53 -j
> ACCEPT
> 
> This would allow servers not in the LAB1 or LAB2
> ranges to access an external 
> DNS server, for example.
> 
> If you want any help understanding how I created the
> range matches in the two 
> chains above, let me know and I'll explain in more
> detail.
> 
> Hopw this helps,
> 
> Antony.
> 
> -- 
> 
> This is not a rehearsal.
> This is Real Life.
> 


__________________________________________________
Do you Yahoo!?
New DSL Internet Access from SBC & Yahoo!
http://sbc.yahoo.com

Re: HELP : How to group IP addresses by refering to them as a single name ?

[Antony Stone]

On Thursday 19 September 2002 7:00 pm, Alok Shukla wrote:

> Let me say if i am able to sort out the lab in the
> accordance that i start my ip settings of lab2
>  like 192.168.9.1-63 for lab 1
>
> and next 64 for lab 2 , would that help and how ?

I think it would help a lot, yes.   I would recommend putting machines into 
three groups:
1. User machines in Lab1
2. User machines in Lab2
3. System machines such as servers, routers, etc.

Separate the IP addresses for each of these three groups so that you can 
specify a single group with an easy netmask.

I'll explain this slowly - apologies if some is too obvious...

192.168.0.0/24 specifies 256 addresses, ranging from 192.168.0.0 to 
192.168.0.255

192.168.0.0/25 specifies 128 addresses, ranging from 192.168.0.0 to 
192.168.0.127.

Similarly 192.168.0.128/25 specifies the other 128 addresses from the 
original range of 256: 192.168.0.128 to 192.168.0.255

Every time you increase the netmask value by one, you are talking about half 
the number of machines (because you are specifying one more bit for the 
network address and one less bit for the host address).

Therefore you can specify groups of the following numbers of addresses:

/24 = 256
/25 = 128
/26 = 64
/27 = 32
/28 = 16
/29 = 8
/30 = 4
/31 = 2
/32 = 1

Hence it is common for ISPs to provide you with a network range such as 
213.121.241.128/27, which means you have 32 addresses.   In the older dotted 
quad netmask notation this would be specified as a netmask of 255.255.255.224

Suppose you rearranged the addresses on your network, so that all the Lab1 
machines had addresses between 192.168.0.0 and 192.168.0.63, all the Lab2 
machines had addresses between 192.168.0.64 and 192.168.0.127, and all the 
routers, servers etc which are not really part of either Lab had addresses 
above 192.168.0.128.

Then you could refer in a netfilter rule to a source address coming from any 
machine in Lab1 by the notation "-s 192.168.0.0/26".

Similarly you could refer to a source address of any machine in Lab2 with the 
notation "-s 192.168.0.64/26", and if you wanted a rule to apply to the other 
machines (routers & servers etc) you could specify "-s 192.168.0.128/26" if 
there were less than 64 of them (or "-s192.168.0.128/27" if there were more 
than 64... unlikely...)

This is the reason I think you would benefit from assigning the machines to 
different address ranges, one smaller subnet per category of machines.

> But i would request you to explain in detail as you said

Okay - here are the rules I suggested earlier, with comments to show why they 
match your current address ranges.

> > # add rules to match machines *not* in LAB1 and
> > return immediately
> > iptables -A LAB1 -s 192.168.0.64/26 -j RETURN

/26 means a group of 64 addresses (see the list above) therefore this rule 
matches the 64 addresses from 192.168.0.64 to 192.168.0.127 and exits the 
chain immediately (returns to the calling chain) if it matches.

> > iptables -A LAB1 -s 192.168.0.56/29 -j RETURN

/29 means a group of 8 addresses, so this rule matches the 8 addresses from 
192.168.0.56 to 192.168.0.63.

When combined with the first rule, we've now matched all machines from 
192.168.0.56 to 192.168.0.127 and exited this chain if the address matches.

> > iptables -A LAB1 -s 192.168.0.52/30 -j RETURN

/30 means a group of 4 addresses, so this rule matches the 4 addresses from 
192.168.0.52 to 192.168.0.55

> > iptables -A LAB1 -s 192.168.0.50/31 -j RETURN

/31 means a group of 2 addresses, so this rule matches the 2 addresses 
192.168.0.50 and 192.168.0.51.

Putting all these four rules together means we have matched any address from 
192.168.0.50 to 192.168.0.127 inclusive, and exited the chain if the source 
address falls into this range.   Only a source address outside that range (ie 
192.168.0.0 to 192.168.0.49, or 192.168.0.128 to 192.168.0.255, and you don't 
have any of the latter range) will continue to get processed by this chain.

> > # now any further rules we put in chain LAB1 will
> > only apply to those machines

And similarly for Lab2:

> > # create user-defined LAB2 chain
> > iptables -N LAB2
> > # add some rules to eliminate non-LAB2 machines
> > iptables -A LAB2 -s 192.168.0.0/27 -j RETURN

/27 matches 32 addresses, here from 192.168.0.0 to 192.168.0.31

> > iptables -A LAB2 -s 192.168.0.32/28 -j RETURN

/28 matches 16 addresses, here from 192.168.0.32 to 192.168.0.47

> > iptables -A LAB2 -s 192.168.0.48/31 -j RETURN

/31 matches two addresses, here from 192.168.0.48 to 192.168.0.49

Hence this combination of three rules will exit for any machine in the range 
192.168.0.0 to 192.168.0.49, further processing in this chain will only 
happen if the source address is 192.168.0.50 or above.

I hope this explains how my two user-defined chains would allow you to create 
rules which would apply only to source addresses from Lab1 or Lab2 ?

Antony.

-- 

Perfection in design is achieved not when there is nothing left to add,
but rather when there is nothing left to take away.

 - Antoine de Saint-Exupery

Re: HELP : How to group IP addresses by refering to them as a single name ?

[Joel Newkirk]

On Thursday 19 September 2002 03:33 pm, Antony Stone wrote:
> On Thursday 19 September 2002 7:00 pm, Alok Shukla wrote:
> > Let me say if i am able to sort out the lab in the
> > accordance that i start my ip settings of lab2
> >  like 192.168.9.1-63 for lab 1
> >
> > and next 64 for lab 2 , would that help and how ?
>
> I think it would help a lot, yes.   I would recommend putting machines into
> three groups:
> 1. User machines in Lab1
> 2. User machines in Lab2
> 3. System machines such as servers, routers, etc.
>
> Separate the IP addresses for each of these three groups so that you can
> specify a single group with an easy netmask.

[snip excellent mask explanation, insert quick'n'dirty script excerpts]

# define convenient symbols for the IPTables rules
#
IPTABLES=/sbin/iptables
# everything from 0.0 to 0.63 is administrator territory
SERVERS="192.168.0.0/26"
# Lab 1 from 0.64 to 0.127
LAB1="192.168.0.64/26"
#Lab2 from 0.128 to 0.191
LAB2="192.168.0.128/26"
#0.192 to 0.255 unassigned for now
FUTUREEXPANSION="192.168.0.192/26"
#
$IPTABLES -t nat -A POSTROUTING -s $LAB1 -j MASQUERADE
# et cetera

The four address ranges can of course be used in any order, this one means reconfiguring 54 machines, changing the server addresses would mean reconfiguring all machines.  (Of course, you'll use student labor anyway... ;^)

You can also create simple scripts to run either manually or on schedule, that do nothing but -A(dd) and -D(elete) the rule for a given lab's address range.
like:

#!/bin/sh
# lab1off
/sbin/iptables -t nat -D -s 192.168.0.64/26 -j MASQUERADE

Re: HELP : How to group IP addresses by refering to them as a single name ?

[Alok Shukla]

HI,

THANKS A LOT..!

I have understood a lot of things. Now just for the
sake..tell me if the following are valid

iptables -t nat -A POSTROUTING -s 192.168.0.10/27 -d
any/0 -J MASQUERADE 

for allowing all the machines starting from 11 to 41

and in the similar way...

if the above is a correct way then it might be a
shortcut but it is still better to design properely
rather than to take shortcuts...

Thanks in Advance

Alok Shukla


--- Antony Stone <Antony@Soft-Solutions.co.uk> wrote:
> On Thursday 19 September 2002 7:00 pm, Alok Shukla
> wrote:
> 
> > Let me say if i am able to sort out the lab in the
> > accordance that i start my ip settings of lab2
> >  like 192.168.9.1-63 for lab 1
> >
> > and next 64 for lab 2 , would that help and how ?
> 
> I think it would help a lot, yes.   I would
> recommend putting machines into 
> three groups:
> 1. User machines in Lab1
> 2. User machines in Lab2
> 3. System machines such as servers, routers, etc.
> 
> Separate the IP addresses for each of these three
> groups so that you can 
> specify a single group with an easy netmask.
> 
> I'll explain this slowly - apologies if some is too
> obvious...
> 
> 192.168.0.0/24 specifies 256 addresses, ranging from
> 192.168.0.0 to 
> 192.168.0.255
> 
> 192.168.0.0/25 specifies 128 addresses, ranging from
> 192.168.0.0 to 
> 192.168.0.127.
> 
> Similarly 192.168.0.128/25 specifies the other 128
> addresses from the 
> original range of 256: 192.168.0.128 to
> 192.168.0.255
> 
> Every time you increase the netmask value by one,
> you are talking about half 
> the number of machines (because you are specifying
> one more bit for the 
> network address and one less bit for the host
> address).
> 
> Therefore you can specify groups of the following
> numbers of addresses:
> 
> /24 = 256
> /25 = 128
> /26 = 64
> /27 = 32
> /28 = 16
> /29 = 8
> /30 = 4
> /31 = 2
> /32 = 1
> 
> Hence it is common for ISPs to provide you with a
> network range such as 
> 213.121.241.128/27, which means you have 32
> addresses.   In the older dotted 
> quad netmask notation this would be specified as a
> netmask of 255.255.255.224
> 
> Suppose you rearranged the addresses on your
> network, so that all the Lab1 
> machines had addresses between 192.168.0.0 and
> 192.168.0.63, all the Lab2 
> machines had addresses between 192.168.0.64 and
> 192.168.0.127, and all the 
> routers, servers etc which are not really part of
> either Lab had addresses 
> above 192.168.0.128.
> 
> Then you could refer in a netfilter rule to a source
> address coming from any 
> machine in Lab1 by the notation "-s 192.168.0.0/26".
> 
> Similarly you could refer to a source address of any
> machine in Lab2 with the 
> notation "-s 192.168.0.64/26", and if you wanted a
> rule to apply to the other 
> machines (routers & servers etc) you could specify
> "-s 192.168.0.128/26" if 
> there were less than 64 of them (or
> "-s192.168.0.128/27" if there were more 
> than 64... unlikely...)
> 
> This is the reason I think you would benefit from
> assigning the machines to 
> different address ranges, one smaller subnet per
> category of machines.
> 
> > But i would request you to explain in detail as
> you said
> 
> Okay - here are the rules I suggested earlier, with
> comments to show why they 
> match your current address ranges.
> 
> > > # add rules to match machines *not* in LAB1 and


__________________________________________________
Do you Yahoo!?
New DSL Internet Access from SBC & Yahoo!
http://sbc.yahoo.com

Re: HELP : How to group IP addresses by refering to them as a single name ?

[Antony Stone]

On Friday 20 September 2002 1:43 pm, Alok Shukla wrote:

> HI,
>
> THANKS A LOT..!
>
> I have understood a lot of things. Now just for the
> sake..tell me if the following are valid
>
> iptables -t nat -A POSTROUTING -s 192.168.0.10/27 -d
> any/0 -J MASQUERADE
>
> for allowing all the machines starting from 11 to 41

Unfortunately not.   You have the right idea, but you can't simply choose the 
starting address anywhere you like :-(

The rule is this: the starting address of the block must be a multiple of the 
size of the block.

So if you're creating a block of 64 machines with a /26 netmask, the first 
address of the block must be 0, 64, 128 or 192.

Similarly, if you want a block of 32 machines with a /27 netmask, the first 
address of the block must be 0, 32, 64, 96, 128, 160, 192 or 224.

In yur case you tried to create a block of 32 machines with a starting 
address of 10, which I'm afraid is not allowed :-)


Hope this helps,

Antony.

-- 

Never write it in Perl if you can do it in Awk.
Never do it in Awk if sed can handle it.
Never use sed when tr can do the job.
Never invoke tr when cat is sufficient.
Avoid using cat whenever possible.

Re: HELP : How to group IP addresses by refering to them as a single name ?

[Darrell A. Escola]

On Fri, Sep 20, 2002 at 02:11:29PM +0100, Antony Stone wrote:
>
> On Friday 20 September 2002 1:43 pm, Alok Shukla wrote:
> 
> > HI,
> >
> > THANKS A LOT..!
> >
> > I have understood a lot of things. Now just for the
> > sake..tell me if the following are valid
> >
> > iptables -t nat -A POSTROUTING -s 192.168.0.10/27 -d
> > any/0 -J MASQUERADE
> >
> > for allowing all the machines starting from 11 to 41
> 
> Unfortunately not.   You have the right idea, but you can't simply choose the 
> starting address anywhere you like :-(
> 
> The rule is this: the starting address of the block must be a multiple of the 
> size of the block.
> 
> So if you're creating a block of 64 machines with a /26 netmask, the first 
> address of the block must be 0, 64, 128 or 192.
> 
> Similarly, if you want a block of 32 machines with a /27 netmask, the first 
> address of the block must be 0, 32, 64, 96, 128, 160, 192 or 224.
> 
> In yur case you tried to create a block of 32 machines with a starting 
> address of 10, which I'm afraid is not allowed :-)
> 
> 
> Hope this helps,
> 
> Antony.
> 

It might be well to note that the "0" host address is reserved for the
network and not useable as a host/node address - the last address in the
subnet is reserved for broadcast - therefore a /27 subnet allows 30 host
addresses. If more than 30 host addresses are needed, use a /26 subnet,
allowing 62 hosts.

-- 
Darrell A. Escola, CCNA(R)
Cisco(R) Certified Network Associate

This message emanates from my personal domain, and conveys solely my own
ideas, opinions, and thoughts; not those of any employer past, present
or future.

Re: HELP : How to group IP addresses by refering to them as a single name ?

[Antony Stone]

On Saturday 21 September 2002 6:34 am, Darrell A. Escola wrote:

> On Fri, Sep 20, 2002 at 02:11:29PM +0100, Antony Stone wrote:
>
> > The rule is this: the starting address of the block must be a multiple of
> > the size of the block.
> >
> > So if you're creating a block of 64 machines with a /26 netmask, the
> > first address of the block must be 0, 64, 128 or 192.
> >
> > Similarly, if you want a block of 32 machines with a /27 netmask, the
> > first address of the block must be 0, 32, 64, 96, 128, 160, 192 or 224.
> >
> > In your case you tried to create a block of 32 machines with a starting
> > address of 10, which I'm afraid is not allowed :-)
>
> It might be well to note that the "0" host address is reserved for the
> network and not useable as a host/node address - the last address in the
> subnet is reserved for broadcast - therefore a /27 subnet allows 30 host
> addresses. If more than 30 host addresses are needed, use a /26 subnet,
> allowing 62 hosts.

No, in this case that's not correct.

What you say is true for the netmask in use on the computers on the network - 
ie if you have a bunch of machines in some network range, and they have a /27 
netmask, then you can only use 30 of the 32 IP addresses for actual 
computers, for precisely the reason you gave.

However, if the computers on your network have a /24 netmask as here (so you 
can have up to 254 machines, plus the .0 network address and the .255 
broadcast address), then .31 is a perfectly acceptable address for one of the 
machines.   .32 is another perfectly acceptable machine address, and you can 
match these using a .0/27 or .32/27 netmask in a netfilter rule.

Your netfilter rules can specify any netmask which is useful to match a range 
of addresses of interest - it doesn't have to match the netmask which is 
actually in use on your network.

Antony.

-- 

If you want to be happy for an hour, get drunk.
If you want to be happy for a year, get married.
If you want to be happy for a lifetime, get a garden.