IP-Range and Subnetmask

IP-Range and Subnetmask

[Bewerbungsadresse@web.de]

hi

i´ve a simple question

is it possible to prevent spoofing attacks to 172.16.0.0-172.31.255.255 
on the external internet IP in one rule?

something like that

iptables -A INPUT -p tcp -s 172.16.0.0/255.31.0.0 -d $INET_IP -i ppp0 -j 
SPOOFED

???

but i think the rule above is wrong
so: is it possible at all?
or do i have to write a loop or all single ip-ranges manually?

thx
greez

Re: IP-Range and Subnetmask

[Thomas Themel]

bewerbungsadresse@web.de wrote on 2003-11-05:
> is it possible to prevent spoofing attacks to 172.16.0.0-172.31.255.255 

> something like that
> iptables -A INPUT -p tcp -s 172.16.0.0/255.31.0.0 -d $INET_IP -i ppp0 -j 
> SPOOFED
> 
> but i think the rule above is wrong

It is. Netmasks are comprised of a sequence of 0..* ones followed by a
sequence of 0..* zeroes, which is why you can write them as /nn, nn
being the number of ones.

255.31.0.0 	= 1111 1111 0000 1111 0000 0000 0000 0000

What you want is

1111 1111 1111 0000 0000 0000 0000 0000 -> /12 if you want it easy,

255.240.0.0 if you like doing binary conversion.


> so: is it possible at all?
> or do i have to write a loop or all single ip-ranges manually?

Not in this case (since you've got an area that fits exactly into a
/12).

ciao,
-- 
[*Thomas  Themel*]  While differing widely in the various little bits we know,
[extended contact]  in our infinite ignorance we are all equal. 
[info provided in]
[*message header*]      - Karl Popper

RE: IP-Range and Subnetmask

[Mark E. Donaldson]

I think this is what you are looking for:
CLASS_B="172.16.0.0/12"

$IPT -t filter -A SPOOFING_RULES -i $FW_INET_IFACE -s $CLASS_B -j
LOG --log-level $LOG_LEVEL --log-prefix "IP SPOOFING ATTEMPT: "
$IPT -t filter -A SPOOFING_RULES -i $FW_INET_IFACE -s $CLASS_B -j DROP


-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Thomas Themel
Sent: Wednesday, November 05, 2003 1:42 PM
To: Bewerbungsadresse@web.de
Cc: netfilter@lists.netfilter.org
Subject: Re: IP-Range and Subnetmask


bewerbungsadresse@web.de wrote on 2003-11-05:
> is it possible to prevent spoofing attacks to 172.16.0.0-172.31.255.255

> something like that
> iptables -A INPUT -p tcp -s 172.16.0.0/255.31.0.0 -d $INET_IP -i ppp0 -j
> SPOOFED
>
> but i think the rule above is wrong

It is. Netmasks are comprised of a sequence of 0..* ones followed by a
sequence of 0..* zeroes, which is why you can write them as /nn, nn
being the number of ones.

255.31.0.0 	= 1111 1111 0000 1111 0000 0000 0000 0000

What you want is

1111 1111 1111 0000 0000 0000 0000 0000 -> /12 if you want it easy,

255.240.0.0 if you like doing binary conversion.


> so: is it possible at all?
> or do i have to write a loop or all single ip-ranges manually?

Not in this case (since you've got an area that fits exactly into a
/12).

ciao,
--
[*Thomas  Themel*]  While differing widely in the various little bits we
know,
[extended contact]  in our infinite ignorance we are all equal.
[info provided in]
[*message header*]      - Karl Popper

IP-Range and Subnetmask

[Bewerbungsadresse@web.de]

hi

i´ve a simple question

is it possible to prevent spoofing attacks to 172.16.0.0-172.31.255.255 
on the external internet IP in one rule?

something like that

iptables -A INPUT -p tcp -s 172.16.0.0/255.31.0.0 -d $INET_IP -i ppp0 -j 
SPOOFED

???

but i think the rule above is wrong
so: is it possible at all?
or do i have to write a loop or all single ip-ranges manually?

thx
greez

RE: IP-Range and Subnetmask

[Martin Ferrari - Decidir IT]

Use the CIDR notation:

172.16.0.0/12

ex.: iptables -A INPUT -p tcp -s 172.16.0.0/12 -d $INET_IP -i ppp0 -j
SPOOFED

> From: Bewerbungsadresse@web.de [mailto:bewerbungsadresse@web.de]
> Sent: Wednesday, November 05, 2003 6:21 PM

> is it possible to prevent spoofing attacks to 
> 172.16.0.0-172.31.255.255 
> on the external internet IP in one rule?
> 
> something like that
> 
> iptables -A INPUT -p tcp -s 172.16.0.0/255.31.0.0 -d $INET_IP 
> -i ppp0 -j 
> SPOOFED

This was wrong, as the netmask should have been 255.240.0.0; the former
netmask was invalid.