LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices



Reply
 
Search this Thread
Old 09-14-2004, 07:53 AM   #1
TheHellsMaster
LQ Newbie
 
Registered: Sep 2004
Posts: 7

Rep: Reputation: 0
Question how to define a specific range of IPs and/or multiple IPs in an iptables rule?...


hi all,

how can I define a customized range of IPs (a segment from 192.168.0.0/24) or multiple IPs in a single iptables rule?...
...if possible at all...

like for example if you want to define source ports form 10 to 25 you type "--sport 10:25" or if you want to use multiple ports you type "-m multiport --sport 3,6,7,32"
...and you don't need to type one and the same rule for each port...

I need to do the same thing for IPs...
using the netmask does not work for me, since the ranges I need to define are custom...


if anyone can help me do this in iptables rule or using external script that will export the IPs - the beer is on me... :-)

10x in advance...
 
Old 09-14-2004, 04:27 PM   #2
stickman
Senior Member
 
Registered: Sep 2002
Location: Nashville, TN
Posts: 1,552

Rep: Reputation: 53
It's as simple as:
-s 192.168.0.0/24
 
Old 09-14-2004, 05:53 PM   #3
TheIrish
Member
 
Registered: Oct 2003
Location: ITALY
Distribution: Debian, Ubuntu, Fedora
Posts: 137

Rep: Reputation: 15
Quote:
It's as simple as:
-s 192.168.0.0/24
piece of cake! But i actually think he meant a more strict range like from 192.168.0.5 to 192.168.1.10.
In this case there's a netfilter patch available... i don't think it passed stable yet, so probably you'll need patch'o'matic: www.netfilter.org
 
Old 09-14-2004, 07:01 PM   #4
scottman
Member
 
Registered: Jul 2004
Location: USA
Distribution: Slackware, FreeBSD, LFS
Posts: 72

Rep: Reputation: 15
You could also try this (wasn't aware of the patch before I started it)

Code:
#!/bin/bash

range1="192.168.55.1:192.168.55.15"

function load_ranges()
{
	if [ $range1 != "" ]; then
		first_num=$(echo "$range1" | cut -d : -f2 | cut -d . -f1)
		second_num=$(echo "$range1" | cut -d : -f2 | cut -d . -f2)
		third_num=$(echo "$range1" | cut -d : -f2 | cut -d . -f3)
		low_range_num=$(echo "$range1" | cut -d : -f1 | cut -d . -f4)
		high_range_num=$(echo "$range1" | cut -d : -f2 | cut -d . -f4)
                counter=1

		# The until loop stops once the top of the range is hit,
		# Note that it stops one ip address before the end of the
		# range.  I'm not sure how to test for greater than

		until [[ $low_range_num = $high_range_num ]];do
			current_ip="$first_num.$second_num.$third_num.$low_range_num"
			
			#you can add your rules here, and use $current_ip for the
			#range.

			#iptables -A FORWARD -i eth1 -d $current_ip -j DROP

			#iptables -A INPUT -d $current_ip -j DROP
						
#echo $current_ip

			let low_range_num=$low_range_num+1

                        let counter=$counter+1
                        if [ $counter = "255" ];then
                                           break
                         fi
		done
	fi
}
load_ranges

Last edited by scottman; 09-15-2004 at 03:17 AM.
 
Old 09-14-2004, 07:59 PM   #5
TheIrish
Member
 
Registered: Oct 2003
Location: ITALY
Distribution: Debian, Ubuntu, Fedora
Posts: 137

Rep: Reputation: 15
phew! pure rock'n'roll
 
Old 09-15-2004, 11:09 AM   #6
TheHellsMaster
LQ Newbie
 
Registered: Sep 2004
Posts: 7

Original Poster
Rep: Reputation: 0
ah, yeah!... :-)

10x for that script - that's about what I ment and it works for me...

as I said - the beer is on me... :-)
 
Old 09-15-2004, 03:38 PM   #7
scottman
Member
 
Registered: Jul 2004
Location: USA
Distribution: Slackware, FreeBSD, LFS
Posts: 72

Rep: Reputation: 15
No prob, I could use a cold one.

You could make it more useful for multiple ranges by taking an argument to it.

load_ranges "$range1"
or
load_ranges "$range2"

That would allow you to replace all times $range1 is used in the function with
$*. Then you could use it for multiple rangers, however you'd bestill be restricted
to one generic ruleset.
Code:
	if [ $* != "" ]; then
		first_num=$(echo "$*" | cut -d : -f2 | cut -d . -f1)
Also be careful with modifying this, any small errors could cause up to
255 output messages
 
Old 09-16-2004, 04:04 AM   #8
TheHellsMaster
LQ Newbie
 
Registered: Sep 2004
Posts: 7

Original Poster
Rep: Reputation: 0
yep... :-)

10x for that too... :-)
it may get in use in future times since now I have a very complicated firewall and with slight exclusions almost every machine or custom range have it's own rules, access and restrictions...

another question...
how about having multiple IPs but not a range?...
...like for example 192.168.0.15, 192.168.0.31 and 192.168.0.134...

currently in such cases I just have a rule for each machine, but it's slower to maintain when some change in the rule is needed - I have to change it for all the machines...
if I was able to define multiple machines in one rule, when a change is needed I'll have to change only one rule... :-)

I was told something for multiple usage of "-s" or "-d" in the rule, like:

iptables -A INPUT -s 192.168.0.15 -s 192.168.0.31 -s 192.168.0.134 -j ACCEPT

...but I haven't been able to test it yet, so I don't know if it actually works and if there's some impact on the performace of the firewall...


any ideas will be appreciated... :-)
 
Old 09-16-2004, 12:48 PM   #9
scottman
Member
 
Registered: Jul 2004
Location: USA
Distribution: Slackware, FreeBSD, LFS
Posts: 72

Rep: Reputation: 15
I tried the multiple -s and -d flags and it gave me a message saying it
wasn't allowed. The way I currently load specific ips or ports is by
having a seperate file, and reading the entries out of there with awk.
Here is a quick example.

Code:
# Drops packets from specific IP's, and rejects outgoing
# communication to them
function black_list()
{
      awk '!/c/{print $3}' $FIREFILE | \
      while read i;do
	    $IPT -A BLACKHOLE -d $i -j REJECT \
	             --reject-with tcp-reset
	     $IPT -A BLACKHOLE -s $i -j DROP
      done
}
This would read everything from the third column of $FIREFILE (just a variable for
the path to the file), and then put it into the variable $i. I put the !/c/ in the awk to stop
it from reading rows that contain the letter c in it. Here's an example file

Code:
a=tcp   b=udp   c=spy         d=lanallow
80	b	 IP_ADD    IP_ADD
20	68	IP_ADD	 d
21	67	c	        d
110   b 	c	        d
25	b	 IP_ADD	  d
a	b	c	        d
a	b	 c	         d
a	b	 c	          d
I know this isn't a very efficient way to do things, but it's what I came up with when I started
my firewall script, just started learning a few months ago. If anyone else has any other ideas or if there's an easier way I'd love to learn about it.

Sorry about the way firefile looks, it should be straight columns...

Last edited by scottman; 09-16-2004 at 12:49 PM.
 
Old 09-20-2004, 11:06 AM   #10
TheHellsMaster
LQ Newbie
 
Registered: Sep 2004
Posts: 7

Original Poster
Rep: Reputation: 0
hmmm...

I'll see if this will work for me...
10x for the help anyway... :-)
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Multiple External IPs with iptables tvynr Linux - Networking 11 11-08-2005 03:31 PM
Question about iptables and multiple external IPs tvynr Linux - Networking 2 10-12-2005 08:48 PM
Using IPCHAINS to allow only a range of IPs ganninu Linux - Security 1 01-13-2004 12:18 PM
IPtables and multiple IPs irclord Linux - Networking 3 09-03-2003 10:18 PM
IPtables and RH8 with multiple IPs irclord Red Hat 0 09-02-2003 11:28 AM


All times are GMT -5. The time now is 08:16 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration