LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 01-28-2016, 09:14 AM   #1
fermion
LQ Newbie
 
Registered: Aug 2015
Posts: 3

Rep: Reputation: Disabled
Need help with one specific iptable rule


I am learning using iptables to set up firewall rules.

I read a book, which has this specific IP rule.

# iptables -I OUTPUT ! -d 192.168.0.100/24 -p icmp -j DROP

The book says this rule, "reject all outbound ICMP traffic to all systems on 192.168.0.0/24, except for system with IP address 192.168.0.100/24."

But when I test it, I found this rule does not block any IP in this segment 192.168.0.x, But instead it block all other IP not on 192.168.0.x.

Have I done anything wrong?


To show what I have done, I did two tests. One with iptables rule on "192.168.0.100", and another on "192.168.0.100/24".

1. Flush iptables rules.
2. ping 192.168.0.100 and 192.168.0.110, and 192.168.1.1 all successful.
3. Add iptables rule.
4. # iptables -I OUTPUT ! -d 192.168.0.100 -p icmp -j DROP
5. Now I can ping 192.168.0.100, but cannot ping 192.168.0.110, or 192.168.1.1.
http://i.imgur.com/T2PH32N.png

Then I did another test, with IP destination as "192.168.0.100/24"
1. Flush iptables rules.
2. ping 192.168.0.100 and 192.168.0.110, and 192.168.1.1 all successful.
3. Add iptables rule.
4. # iptables -I OUTPUT ! -d 192.168.0.100/24 -p icmp -j DROP
5. Now I can ping both 192.168.0.100, 192.168.0.110, but not 192.168.1.1.

http://i.imgur.com/fJ4PUvw.png

So my conclusion is that, in iptables rule, IP address with prefix is translated to whole IP subset IPs. "192.168.0.100/24" and "192.168.0.0/24" are exactly the same.

Last edited by fermion; 01-28-2016 at 12:07 PM. Reason: "Made a mistake about blocking" "add two figures"
 
Old 01-28-2016, 10:43 AM   #2
lazydog
Senior Member
 
Registered: Dec 2003
Location: The Key Stone State
Distribution: CentOS Sabayon and now Gentoo
Posts: 1,249
Blog Entries: 3

Rep: Reputation: 194Reputation: 194
What book? ISBN #?
Is this a school question?
 
Old 01-28-2016, 11:09 AM   #3
fermion
LQ Newbie
 
Registered: Aug 2015
Posts: 3

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by lazydog View Post
What book? ISBN #?
Is this a school question?
Thanks for your reply. It's not a school question.

The book's ISBN is 1495148203. It's a RHCSA and RHCE training guide. I am using it to prepare for my RHCSA exam.

I have made contact with the author, and author said no problem with the rule. But I tested the rule multiple times and found it did not really work in the way as the book described.
 
Old 01-28-2016, 01:10 PM   #4
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: Rocky Linux
Posts: 4,765

Rep: Reputation: 2209Reputation: 2209Reputation: 2209Reputation: 2209Reputation: 2209Reputation: 2209Reputation: 2209Reputation: 2209Reputation: 2209Reputation: 2209Reputation: 2209
Quote:
Originally Posted by fermion View Post
So my conclusion is that, in iptables rule, IP address with prefix is translated to whole IP subset IPs. "192.168.0.100/24" and "192.168.0.0/24" are exactly the same.
They are exactly the same. The "/24" says to ignore everything except the high-order 24 bits. For an exact address, either leave off the "/xx" or use "/32".
 
1 members found this post helpful.
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] iptable rule amartlk Linux - Newbie 2 12-18-2011 11:36 PM
iptable how many rule iptable can manage toure32 Linux - Networking 1 05-13-2010 05:34 AM
iptable rule vinaytp Linux - Newbie 1 10-26-2009 02:39 AM
Same Iptable rule to be avoided? Santoshkb Linux - Networking 2 12-21-2007 06:55 AM
complex iptable rule help farhan Linux - Security 2 08-31-2005 10:58 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 03:16 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration