How to block a range of IPs?

How to block a range of IPs?

[Afshin Lamei]

Hi,
How can I write a rule for a custom range of IPs? for example, I want to 
block every WWW packet incoming from eth1, which source is an IP between 
192.168.1.10 and 192.168.1.20.
please help me writing an example.
thank you
afshin





_________________________________________________________________
Help STOP SPAM with the new MSN 8 and get 2 months FREE*  
http://join.msn.com/?page=features/junkmail

RE: How to block a range of IPs?

[Michael K]

> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org 
> [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Afshin Lamei
> Sent: Sunday, April 27, 2003 8:12 AM
> To: netfilter@lists.netfilter.org
> Subject: How to block a range of IPs?
> 
> 
> Hi,
> How can I write a rule for a custom range of IPs? for 
> example, I want to 
> block every WWW packet incoming from eth1, which source is an 
> IP between 
> 192.168.1.10 and 192.168.1.20.
> please help me writing an example.
> thank you
> afshin
> 
> 

You can't, but if you subnet, the closest will be 192.168.1.1 to
192.168.0.14 using mask 255.255.255.240.
Or 192.168.1.1 to 192.168.0.30 using mask 255.255.255.224.

Example:
iptables -A INPUT -i eth0 -p tcp -s 192.168.1.0/255.255.255.240 --dport
www -j DROP

/Klintan

Re: How to block a range of IPs?

[Cedric Blancher]

Le dim 27/04/2003 à 08:11, Afshin Lamei a écrit :
> How can I write a rule for a custom range of IPs? for example, I want to 
> block every WWW packet incoming from eth1, which source is an IP between 
> 192.168.1.10 and 192.168.1.20.

A bit HS, but a quite wonderful tool for this kind of situation.
netmask, distributed with Debian, allows you to find all subnets that
cover an arbitrary IP range :

	cbr@elendil:~$ netmask 192.168.1.10:192.168.1.20
	   192.168.1.10/31
	   192.168.1.12/30
	   192.168.1.16/30
	   192.168.1.20/32

Now you have coverd your range, just implement your 4 rules.

The other solution is to find a single subnet that covers your whole
range. In your case, the minimal one seems to 192.168.1.1/27 that covers
from 192.168.1.1 to 192.168.1.31.

	cbr@elendil:~$ netmask -r 192.168.1.1/27
	    192.168.1.0-192.168.1.31    (32)

Now you have a single rule, but it covers a much larger range than you
need.

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
IT systems and networks security - Cartel Sécurité
Phone : +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE

RE: How to block a range of IPs?

[Martin Josefsson]

On Sun, 2003-04-27 at 09:25, Michael K wrote:
> > -----Original Message-----
> > From: netfilter-admin@lists.netfilter.org 
> > [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Afshin Lamei
> > Sent: Sunday, April 27, 2003 8:12 AM
> > To: netfilter@lists.netfilter.org
> > Subject: How to block a range of IPs?
> > 
> > 
> > Hi,
> > How can I write a rule for a custom range of IPs? for 
> > example, I want to 
> > block every WWW packet incoming from eth1, which source is an 
> > IP between 
> > 192.168.1.10 and 192.168.1.20.
> > please help me writing an example.
> > thank you
> > afshin
> > 
> > 
> 
> You can't, but if you subnet, the closest will be 192.168.1.1 to
> 192.168.0.14 using mask 255.255.255.240.
> Or 192.168.1.1 to 192.168.0.30 using mask 255.255.255.224.

Actually you can... with the new iprange match in patch-o-matic.

-- 
/Martin

Re: How to block a range of IPs?

[John A. Sullivan III]

You can  use the tool at http://subnetcreator.sourceforge.net/ to easily
determine which subnets are contained in your IP address range.  The
same logic is being built into the iptables+ management tool being
developed in http://iscs.sourceforge.net/ .  However,even better,it
appears there is a patch available in patch-o-matic that allows one to
enter a range directly in iptables.  I haven't tried it yet but hope to
do so soon to replace that logic in ISCS.  Good luck - John

On Sun, 2003-04-27 at 10:06, netfilter-request@lists.netfilter.org
wrote:
> --__--__--
> 
> Message: 4
> From: "Afshin Lamei" <linux_st@hotmail.com>
> To: netfilter@lists.netfilter.org
> Subject: How to block a range of IPs?
> Date: Sun, 27 Apr 2003 10:41:54 +0430
> 
> Hi,
> How can I write a rule for a custom range of IPs? for example, I want to 
> block every WWW packet incoming from eth1, which source is an IP between 
> 192.168.1.10 and 192.168.1.20.
> please help me writing an example.
> thank you
> afshin
> 
> 
> 
> 
> 
> _________________________________________________________________
> Help STOP SPAM with the new MSN 8 and get 2 months FREE*  
> http://join.msn.com/?page=features/junkmail
> 
> 
-- 
John A. Sullivan III
Chief Technology Officer
Nexus Management
+1 207-985-7880
john.sullivan@nexusmgmt.com
---
If you are interested in helping to develop a GPL enterprise class
VPN/Firewall/Security device management console, please visit
http://iscs.sourceforge.net 

Re: How to block a range of IPs?

[SaVaGE]

Op maandag 28 april 2003 18:14, schreef John A. Sullivan III:
> You can  use the tool at http://subnetcreator.sourceforge.net/ to easily
> determine which subnets are contained in your IP address range.  The
> same logic is being built into the iptables+ management tool being
> developed in http://iscs.sourceforge.net/ .  However,even better,it
> appears there is a patch available in patch-o-matic that allows one to
> enter a range directly in iptables.  I haven't tried it yet but hope to
> do so soon to replace that logic in ISCS.  Good luck - John
>
> On Sun, 2003-04-27 at 10:06, netfilter-request@lists.netfilter.org
>
> wrote:
> > --__--__--
> >
> > Message: 4
> > From: "Afshin Lamei" <linux_st@hotmail.com>
> > To: netfilter@lists.netfilter.org
> > Subject: How to block a range of IPs?
> > Date: Sun, 27 Apr 2003 10:41:54 +0430
> >
> > Hi,
> > How can I write a rule for a custom range of IPs? for example, I want to
> > block every WWW packet incoming from eth1, which source is an IP between
> > 192.168.1.10 and 192.168.1.20.
> > please help me writing an example.
> > thank you
> > afshin
> >
> >
> >
> >
> >
> > _________________________________________________________________
> > Help STOP SPAM with the new MSN 8 and get 2 months FREE*
> > http://join.msn.com/?page=features/junkmail


AT_HOME_RANGE="213.51.16.0/21 213.51.24.0/21
	 
 ${ECHO} -n "Drop and log @HOME_USERS in range: "
    for athomerange in ${AT_HOME_RANGE} ; do
           ${IPTABLES} -A INPUT -i ${EXT_INTERFACE} -s ${athomerange} -m limit 
\   
               -j LOG --log-prefix "@HOME_USER:DROP "
          ${IPTABLES} -A @HOME_CHK -i ${EXT_INTERFACE} -s ${athomerange} -j 
DROP
        ${ECHO} -n "${athomerange} "
  done
  
this is an example off a line i use  , if you wish to have more ranges, you 
have to make a new rule like this ,but another name like "AT_HOME_RANGE2" 

good luck

Pascal (PC-Secure)

Re: How to block a range of IPs?

[SaVaGE]

Op maandag 28 april 2003 19:41, schreef u:
> Op maandag 28 april 2003 18:14, schreef John A. Sullivan III:
> > You can  use the tool at http://subnetcreator.sourceforge.net/ to easily
> > determine which subnets are contained in your IP address range.  The
> > same logic is being built into the iptables+ management tool being
> > developed in http://iscs.sourceforge.net/ .  However,even better,it
> > appears there is a patch available in patch-o-matic that allows one to
> > enter a range directly in iptables.  I haven't tried it yet but hope to
> > do so soon to replace that logic in ISCS.  Good luck - John
> >
> > On Sun, 2003-04-27 at 10:06, netfilter-request@lists.netfilter.org
> >
> > wrote:
> > > --__--__--
> > >
> > > Message: 4
> > > From: "Afshin Lamei" <linux_st@hotmail.com>
> > > To: netfilter@lists.netfilter.org
> > > Subject: How to block a range of IPs?
> > > Date: Sun, 27 Apr 2003 10:41:54 +0430
> > >
> > > Hi,
> > > How can I write a rule for a custom range of IPs? for example, I want
> > > to block every WWW packet incoming from eth1, which source is an IP
> > > between 192.168.1.10 and 192.168.1.20.
> > > please help me writing an example.
> > > thank you
> > > afshin
> > >
> > >
> > >
> > >
> > >
> > > _________________________________________________________________
> > > Help STOP SPAM with the new MSN 8 and get 2 months FREE*
> > > http://join.msn.com/?page=features/junkmail
>
> AT_HOME_RANGE="213.51.16.0/21 213.51.24.0/21"
>
>  ${ECHO} -n "Drop and log @HOME_USERS in range: "
>     for athomerange in ${AT_HOME_RANGE} ; do
>            ${IPTABLES} -A INPUT -i ${EXT_INTERFACE} -s ${athomerange} -m
> limit \
>                -j LOG --log-prefix "@HOME_USER:DROP "
>           ${IPTABLES} -A @HOME_CHK -i ${EXT_INTERFACE} -s ${athomerange} -j
> DROP
>         ${ECHO} -n "${athomerange} "
>   done
>
> this is an example off a line i use  , if you wish to have more ranges, you
> have to make a new rule like this ,but another name like "AT_HOME_RANGE2"
>
> good luck
>
> Pascal (PC-Secure)



so in your picture it would be like this ::


EXT_INTERFACE="eth1"
IPTABLES="/usr/bin/iptables
AT_HOME_RANGE="192.168.1.10/24 192.168.1.20/24"

 ${ECHO} -n "Drop and log @HOME_USERS in range: "
    for athomerange in ${AT_HOME_RANGE} ; do
            ${IPTABLES} -A INPUT -i ${EXT_INTERFACE} -s ${athomerange} -m
 limit \
                -j LOG --log-prefix "@HOME_USER:DROP "
           ${IPTABLES} -A INPUT -i ${EXT_INTERFACE} -s ${athomerange} -j
 DROP
         ${ECHO} -n "${athomerange} "
   done

ready and go

Pascal (PC-Secure)

Re: How to block a range of IPs?

[SaVaGE]

Op maandag 28 april 2003 19:52, schreef u:
> Op maandag 28 april 2003 19:41, schreef u:
> > Op maandag 28 april 2003 18:14, schreef John A. Sullivan III:
> > > You can  use the tool at http://subnetcreator.sourceforge.net/ to
> > > easily determine which subnets are contained in your IP address range. 
> > > The same logic is being built into the iptables+ management tool being
> > > developed in http://iscs.sourceforge.net/ .  However,even better,it
> > > appears there is a patch available in patch-o-matic that allows one to
> > > enter a range directly in iptables.  I haven't tried it yet but hope to
> > > do so soon to replace that logic in ISCS.  Good luck - John
> > >
> > > On Sun, 2003-04-27 at 10:06, netfilter-request@lists.netfilter.org
> > >
> > > wrote:
> > > > --__--__--
> > > >
> > > > Message: 4
> > > > From: "Afshin Lamei" <linux_st@hotmail.com>
> > > > To: netfilter@lists.netfilter.org
> > > > Subject: How to block a range of IPs?
> > > > Date: Sun, 27 Apr 2003 10:41:54 +0430
> > > >
> > > > Hi,
> > > > How can I write a rule for a custom range of IPs? for example, I want
> > > > to block every WWW packet incoming from eth1, which source is an IP
> > > > between 192.168.1.10 and 192.168.1.20.
> > > > please help me writing an example.
> > > > thank you
> > > > afshin
> > > >
> > > >
> > > >
> > > >
> > > >
> > > > _________________________________________________________________
> > > > Help STOP SPAM with the new MSN 8 and get 2 months FREE*
> > > > http://join.msn.com/?page=features/junkmail
> >
> > AT_HOME_RANGE="213.51.16.0/21 213.51.24.0/21"
> >
> >  ${ECHO} -n "Drop and log @HOME_USERS in range: "
> >     for athomerange in ${AT_HOME_RANGE} ; do
> >            ${IPTABLES} -A INPUT -i ${EXT_INTERFACE} -s ${athomerange} -m
> > limit \
> >                -j LOG --log-prefix "@HOME_USER:DROP "
> >           ${IPTABLES} -A @HOME_CHK -i ${EXT_INTERFACE} -s ${athomerange}
> > -j DROP
> >         ${ECHO} -n "${athomerange} "
> >   done
> >
> > this is an example off a line i use  , if you wish to have more ranges,
> > you have to make a new rule like this ,but another name like
> > "AT_HOME_RANGE2"
> >
> > good luck
> >
> > Pascal (PC-Secure)
>
> so in your picture it would be like this ::
>
>
> EXT_INTERFACE="eth1"
> IPTABLES="/usr/bin/iptables
> AT_HOME_RANGE="192.168.1.10/24 192.168.1.20/24"
>
>  ${ECHO} -n "Drop and log @HOME_USERS in range: "
>     for athomerange in ${AT_HOME_RANGE} ; do
>             ${IPTABLES} -A INPUT -i ${EXT_INTERFACE} -s ${athomerange} -m
>  limit \
>                 -j LOG --log-prefix "@HOME_USER:DROP "
>            ${IPTABLES} -A INPUT -i ${EXT_INTERFACE} -s ${athomerange} -j
>  DROP
>          ${ECHO} -n "${athomerange} "
>    done
>
> ready and go
>
> Pascal (PC-Secure)

ok i forgot your wish for the www port so here it is::

EXT_INTERFACE="eth1" # or INT_INTERFACE
IPTABLES="/usr/bin/iptables
AT_HOME_RANGE="192.168.1.10/24 192.168.1.20/24"

 ${ECHO} -n "Drop and log @HOME_USERS in range: "
    for athomerange in ${AT_HOME_RANGE} ; do
           ${IPTABLES} -A INPUT -i ${EXT_INTERFACE} -p all -s ${athomerange} \ 
	--dport 80 -m limit -j LOG --log-prefix "@HOME_USER:DROP "
           ${IPTABLES} -A INPUT -i ${EXT_INTERFACE} -p all -s ${athomerange} \
 	--dport 80 -j DROP
         ${ECHO} -n "${athomerange} "
   done

 

Re: How to block a range of IPs?

[Jozsef Kadlecsik]

On 28 Apr 2003, John A. Sullivan III wrote:

> You can  use the tool at http://subnetcreator.sourceforge.net/ to easily
> determine which subnets are contained in your IP address range.  The
> same logic is being built into the iptables+ management tool being
> developed in http://iscs.sourceforge.net/ .  However,even better,it
> appears there is a patch available in patch-o-matic that allows one to
> enter a range directly in iptables.  I haven't tried it yet but hope to
> do so soon to replace that logic in ISCS.  Good luck - John

As Martin pointed out, there is an iprange match in patch-o-matic by which
one can specify IP address ranges.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary