module matches a set of source or destination ip addresses

module matches a set of source or destination ip addresses

[Igor Popov]

[-- Attachment #1: Type: text/plain, Size: 295 bytes --]

	Hi all,
It there iptables module(something like mport), but that matches a set of 
source or destination ip addresses:
iptables -A ... -p ... -m megamatcher -s ip1,ip2,...-d ip1,ip2,... -j ...

-- 
I have great faith in fools -- self confidence my friends call it.
		-- Edgar Allan Poe

[-- Attachment #2: Type: application/pgp-signature, Size: 479 bytes --]

Re: module matches a set of source or destination ip addresses

[Taylor Grant]

Igor Popov wrote:
> 	Hi all,
> It there iptables module(something like mport), but that matches a set of 
> source or destination ip addresses:
> iptables -A ... -p ... -m megamatcher -s ip1,ip2,...-d ip1,ip2,... -j ...
> 

If the IPs in question are in a subnet you can always specify the subnet it's self.  I.e.

iptables -A ... -p ... -s 192.168.0.0/24 -d 172.30.16.0/128 ... -j ...

You might want to take a look at the set match.  Set uses an external program (ipset?) to create and maintain the sets that are matched against.  I think set will allow you to have multiple IPs in it that are not necessarily in the same subnet or contiguous.  So that may do it for you.  I have not messed with ipset so I'm not much help for you.  Though a read of the man for it should help.



Grant. . . .