Multiple Source Addresses

Multiple Source Addresses

[Keller Nicolas]

Hi!

I want to log every packet that *doesn't* come from IP1 and IP2 (because
these two hosts should be the only one that communicate with the
Firewall). Up to now I couldn't figure out a way to do this, as it is
NOT possible to include multiple source addresses in one line, like
this:

iptables -A INPUT -s !192.168.43.1 !192.168.43.2 -j LOG

Anyone can show me a way to get this to work?

Thank you very much!

Nicolas Keller

Re: Multiple Source Addresses

[Martijn Lievaart]

Keller Nicolas wrote:

>Hi!
>
>I want to log every packet that *doesn't* come from IP1 and IP2 (because
>these two hosts should be the only one that communicate with the
>Firewall). Up to now I couldn't figure out a way to do this, as it is
>NOT possible to include multiple source addresses in one line, like
>this:
>
>iptables -A INPUT -s !192.168.43.1 !192.168.43.2 -j LOG
>
>Anyone can show me a way to get this to work?
>  
>

Simple.

iptables -N LOGSOME
iptables -A INPUT -j LOGSOME
iptables -A LOGSOME -s 192.168.43.1 -j RETURN
iptables -A LOGSOME -s 192.168.43.2 -j RETURN
iptables -A LOGSOME -j LOG

HTH,
M4

RE: Multiple Source Addresses

[Brad Morgan]

How about:

iptables -N good-ips
iptables -A good-ips -s 192.168.43.1 -j RETURN
iptables -A good-ips -s 192.168.43.2 -j RETURN
iptables -A good-ips -j LOG

and add:

iptables -A INPUT -j good-ips

in the appropriate place.

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Keller Nicolas
Sent: Tuesday, April 15, 2003 10:29 AM
To: netfilter@lists.netfilter.org
Subject: Multiple Source Addresses


Hi!

I want to log every packet that *doesn't* come from IP1 and IP2 (because
these two hosts should be the only one that communicate with the
Firewall). Up to now I couldn't figure out a way to do this, as it is
NOT possible to include multiple source addresses in one line, like
this:

iptables -A INPUT -s !192.168.43.1 !192.168.43.2 -j LOG

Anyone can show me a way to get this to work?

Thank you very much!

Nicolas Keller

RE: Multiple Source Addresses

[Daniel Chemko]

# Create a new table to process traffic you don't like
iptables -N NORMAL_TRAFFIC

# Log unwanted traffic
iptables -A OTHER _TRAFFIC -j log
# Do what you want with the packet after being logged
iptables -A OTHER _TRAFFIC -j ACCEPT, DROP, REJECT, or Whatever

# Allow ok traffic through
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow your accepted traffic through
iptables -A INPUT -s 192.168.43.1 -j ACCEPT
iptables -A INPUT -s 192.168.43.2 -j ACCEPT

# Send all unwanted traffic to get logged & ?
iptables -A INPUT -j OTHER_TRAFFIC


-----Original Message-----
From: Keller Nicolas [mailto:nicolas.keller@slb.de] 
Sent: Tuesday, April 15, 2003 9:29 AM
To: netfilter@lists.netfilter.org
Subject: Multiple Source Addresses

Hi!

I want to log every packet that *doesn't* come from IP1 and IP2 (because
these two hosts should be the only one that communicate with the
Firewall). Up to now I couldn't figure out a way to do this, as it is
NOT possible to include multiple source addresses in one line, like
this:

iptables -A INPUT -s !192.168.43.1 !192.168.43.2 -j LOG

Anyone can show me a way to get this to work?

Thank you very much!

Nicolas Keller

Re: Multiple Source Addresses

[Aaron Berg]

Try something like this:

iptables -N allowable
#you should limit which traffic is sent through this chain
iptables -A input -j allowable
#list of IPs to allow
iptables -A allowable -s 192.168.43.1 -j ACCEPT
iptables -A allowable -s 192.168.43.2 -j ACCEPT
#It will only do this rule if it doesn't match any rules before it in the 
chain
iptables -A allowable -j LOG

I haven't tested this, but it should do the trick.

On Tuesday 15 April 2003 9:28 am, Keller Nicolas wrote:
> Hi!
>
> I want to log every packet that *doesn't* come from IP1 and IP2 (because
> these two hosts should be the only one that communicate with the
> Firewall). Up to now I couldn't figure out a way to do this, as it is
> NOT possible to include multiple source addresses in one line, like
> this:
>
> iptables -A INPUT -s !192.168.43.1 !192.168.43.2 -j LOG
>
> Anyone can show me a way to get this to work?
>
> Thank you very much!
>
> Nicolas Keller

unsubsrcibe

[Linux]