hi all!

i have this network going on 192.168.0.0
and i would like to drop the incoming packets from 192.168.0.20-192.168.0.50 and i want to write one rule for it not thirty...see wat i mean? what option and how to write it? please

thx!!

There is an iprange filter match. A rule that you are asking for looks like the following:

or
Hope this helps!

Interesting, yet, I may have modprobe issues with libipt_iprange loading.

Edit: My aim is to allow packets to be sent to and from a (source ip range) or (single ip) to a (destination ip range) or (single ip) for each policy that I have set.

For example, DNS:

$IPT -A tcp_inbound -p TCP --src-range 192.168.0.1-192.168.0.6 -d 192.168.0.2 --destination-port 53 -j ACCEPT

$IPT -A tcp_outbound -p TCP -s 192.168.0.2 --dst-range 192.168.0.1-192.168.0.6 --destination-port 53 -j ACCEPT

192.168.0.1 is obviously a gateway with dhcp client ranging from 192.168.0.2-192.168.0.6 =)

192.168.0.2 is a DNS server, as you can tell..the DNS server handles requests... and all requests are sent to and from the DNS server, but I wish to only allow a specific range of IP in the DHCP range, to accept those packets.

Please note: I know how iptables work, I don't need a complete tutorial on iptables, just relevance to iprange. Thanks.

Regards,

WolF-X

i'm not sure i understand what your question is exactly... could you be a little more specific please?? BTW, DNS uses UDP, not TCP...

Well actually it uses both, since you don't use windows, you obviously don't know about the services file...In the meantime, I'll just wait for a reply from someone else.

yes, you can make DNS work with TCP on linux too if you want... in fact most DNS daemons will have TCP fallback...

once again, could you please explain your question?? are the rules not working for you or something like that??

EDIT: i can see you've updated your post now... thanks...

Quite frankly, I think it's just the fact that the module libipt_iprange.so cannot be identified by the kernel...

I have updated to the latest version of iptables 1.3.5 =(

You see I have 1 network but a physical and wireless network.

I want to only allow most of what i have specified as ACCEPTED by the physical network, and only allow such things as HTTP,HTTPS,POP3,SMTP and DNS etc - common services to be allowed from the range of IPs that wireless clients use.

It's pretty much to disallow a friend of mine of trying to hack my network, he wants to be this big hacker and all :P

if your problem is that these rules aren't working, my money is on the missing match specifier...

i think it should go something like this:

I tried that exactly, except previously I didn't add the '\' perhaps it may work, but I still get a problem with the module, though, I tried a modprobe on it, couldn't locate it.

Any method of installing the module, tried insmod, but I suppose I'm supposed to insmod on the .o file yeh?

Thanks.

no, the \ doesn't have anything to do with this... it's just something you use to be able to span commands across multiple lines for clarity's sake...

you shouldn't have to modprobe anything... upon executing the commands, the ipt_iprange module should get loaded automatically...

wait you patched your kernel for this?? if so, make sure you recompiled iptables after doing so...

Patched nor recompiled, recompiling takes ages eugh... do i really have to? :P

i don't know if you *have* to... but that's how i've always applied netfilter patches (apply patch to kernel source, recompile kernel, boot new kernel, then recompile iptables)...

i'd assume that if you successfully added the module without recompiling the kernel, you'd still need to recompile iptables - which takes only a few seconds...

Just adding all those '-m iprange' bits in the script...

recompile iptable, how? make install or....?

usually for iptables it goes something like:

Can you the post the whole error line you are getting & your iptable rule for which you are getting that error? And if in case you are not having ipt_iprange module loaded in kernel; then you should get an error of "No chain/target/match by that name"