Hello,

So here is my current problem

I am trying to filter all traffic on several ports down to a specific range of IP addresses. I have created a chain to do this called "filter" and another to jump too, named "allow", if the rule matches to accept the traffic.

Right now my filter chain looks like this, minus some stuff to let 192.168 in because both my comp and the firewall comp are behind a router for the moment.

iptables -A filter -s 123.123.0.0/255.255.155.0 -j DROP
iptables -A filter -s 123.123.0.0/255.255.105.0 -j allow
iptables -A filter -j DROP

With this i want only 123.123.100.x-123.123.150.x traffic to be accepted

The idea is a drop all packets below the range minimum then accept all the surviving packets below the range maximum. Anything left over gets dropped. Unfortunately the range max(2nd) rule doesn't seem to be matching..

I have not tested the first rule, range min, to see if it also doesn't match but commenting it out doesn't help so I'm ignoring it for now.

The IP i am testing it from would be 123.123.107.123

when i add a rule to allow 123.123.0.0/16 i can get in fine.

I have used this site to determine the values i use in my rules:
http://www.csgnetwork.com/ipinfocalc.html

"iptables -L -v" shows that the packets are getting dropped in the last rule above.

any ideas as to what may be wrong? also, any better ways to specify a specific IP range in an iptables rule?

thanks in advance.

Its late so someone correct me if I am wrong, but this isn't a valid subnet mask.

That's an awfully big block of IPs to allow traffic from. It would be easier to simply write your firewall as though it were accessible to everyone.

This should help.
http://www.csc.fi/english/funet/calc/laskin2.html

I was going to try to do the math to figure out all teh subnets, but its WAY too late for that.

Thanks to both of you for replying. It probably is an invalid subnet mask which i was hoping wasn't the case. . iptables didn't complain to me when i added it so i was thinking it might still work. It was worth a shot. I should do some reading to get more up to speed on this.

That site looks like just what i need.

Thanks again!