Blocking an ip address range within iptables

kaplan71 · 03-30-2009, 03:48 PM

Hi there --

I am setting up a iptables firewall on one of our servers, and I would like to block a range of addresses from getting into the system. I am using a script that does a BLACKIN and BLACKOUT methodology for specific addresses. One example is the following:

Code:

$IPTABLES -A BLACKIN -s 202.109.114.147 -j DROP
...
$IPTABLES -A BLACKOUT -d 202.109.114.117 -j DROP

What would be the correct syntax to use if I wanted to block an entire remote subnet from getting into the server? Thanks.

anomie · 03-30-2009, 04:30 PM

Good news -- iptables supports netmasks. From man iptables(8):

Quote:

-s, --source [!] address[/mask]

Source specification. Address can be either a network name, a
hostname (please note that specifying any name to be resolved
with a remote query such as DNS is a really bad idea), a network
IP address (with /mask), or a plain IP address. The mask can be
either a network mask or a plain number, specifying the number
of 1’s at the left side of the network mask. Thus, a mask of 24
is equivalent to 255.255.255.0. A "!" argument before the
address specification inverts the sense of the address. The flag
--src is an alias for this option.

win32sux · 03-31-2009, 12:41 AM

Also, if you literally want to use ranges (instead of subnets), you can do like:

Code:

$IPTABLES -A BLACKIN -m iprange --src-range 202.109.114.117-202.109.114.147 -j DROP

kaplan71 · 03-31-2009, 01:33 PM

Hi there --

Thanks for your reply. I went ahead with the iprange option using the following syntax:

Code:

$IPTABLES -A BLACKIN -m iprange --src-range xxx.xxx.xxx.0-xxx.xxx.xxx.255 -j DROP
...
$IPTABLES -A BLACKOUT -m iprange --dst-range xxx.xxx.xxx.0-xxx.xxx.xxx.255 -j DROP

I ran the script with no apparent error messages. The output of the iptables -vnL command in regards to the above example showed the following:

Quote:

Chain BLACKIN (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 source IP range xxx.xxx.xxx.0-xxx.xxx.xxx.255

Chain BLACKOUT (0 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 destination IP range xxx.xxx.xxx.0-xxx.xxx.xxx.255

Unless I am mistaken, is that the correct output? Thanks.

win32sux · 03-31-2009, 02:55 PM

Looks good to me.