Help with firewall, can't deny ips after allowing local subnet

abefroman · 02-23-2010, 07:14 PM

If I allow, my server's IP is:
11.11.11.11

If I allow 11.11.11.11, and block 22.22.22.22

22.22.22.22 can't access the server

But if I allow 11.11.11.0/24, and block 22.22.22.22

22.22.22.22 can still access the server!!

Does anyone know why that is?

TIA

Noway2 · 02-23-2010, 07:44 PM

I would think that it should not. 11.11.11.0/24 and 22.22.22.22 are separate networks.

What are you using for a firewall and how are you performing the testing? There has to be an explaination for what you are experiencing. No doubt it will be one of those, Doh! moments once you figure it out

abefroman · 02-23-2010, 07:59 PM

Quote:

Originally Posted by Noway2

I would think that it should not. 11.11.11.0/24 and 22.22.22.22 are separate networks.

What are you using for a firewall and how are you performing the testing? There has to be an explaination for what you are experiencing. No doubt it will be one of those, Doh! moments once you figure it out

I use the APF firewall, and I tried to SSH in from an IP that I blocked, and it worked. If I remove the /24 ssh access is denied.

Noway2 · 02-24-2010, 05:20 AM

You may want to check the documentation for APF because it looks like it may not support CIDR notation. I haven't used it personally, but in an attempt to help you I read the posts in several forums where others were trying to block a range of IP addresses. In each case the suggestion was that if you wanted to block a specific IP address that APF handled it very simply. However, if they wanted to block a range (x.x.x.0/24), that they needed to add an entry into IP tables.

nowonmai · 02-24-2010, 05:34 AM

Post the output of...
iptables -L
ifconfig
route