iptables and groups of ips

LinuxGeek · 01-30-2007, 03:07 AM

Hi,
I was wondering if there's any way that I can specify a ips and not a range in an iptables rules. I'm aware of the iprange module, but that only helps if the IPs are a range. Below is an example of what I'm trying to do:

These 3 are in a group:

172.16.0.1
172.16.0.9
172.16.0.90

What I'm trying to do is: iptables -INPUT -p tcp -s 172.16.0.1,172.16.0.9,172.16.0.90 -j DROP

Any ideas? Thanks for your help.

IBall · 01-30-2007, 08:23 PM

You could just put each IP address as a separate rule.

Code:

iptable -INPUT -p tcp -s 172.16.0.1 -j DROP
iptable -INPUT -p tcp -s 172.16.0.9 -j DROP
iptable -INPUT -p tcp -s 172.16.0.90 -j DROP

I hope this helps
--Ian

CrEsPo · 01-30-2007, 09:06 PM

You could also create a chain.

Code:

iptables -N bannedIPs // create a new chain
// add your custom rules
iptables -A bannedIPs -p tcp -s 172.16.0.1 -j DROP
iptables -A bannedIPs -p tcp -s 172.16.0.9 -j DROP
iptables -A bannedIPs -p tcp -s 172.16.0.90 -j DROP
iptables -A INPUT -j bannedIPs // add the chain to the INPUT

Anything after // is a comment.

LinuxGeek · 01-31-2007, 02:42 AM

Thanks. I currently do what CrEsPo suggested, which is to create a separate chain for the IPs and then set the rules there, but I was wondering if there was anything like iprange but for non-sequential IPs. Thanks.

javaroast · 02-01-2007, 01:51 AM

I run it as a bash script using variables:

bannedIPs="192.168.1.1 192.168.1.4 192.168.1.7"

for bip in $bannedIPs
do
iptables -A $bannedIPs -p tcp -s 172.16.0.1 -j DROP

javaroast · 02-01-2007, 01:52 AM

I run it as a bash script using variables:

bannedIPs="192.168.1.1 192.168.1.4 192.168.1.7"

for bip in $bannedIPs
do
iptables -A $bannedIPs -p tcp -s 172.16.0.1 -j DROP
done

This allows me to easily add new ip's to the list

LinuxGeek · 02-01-2007, 04:26 PM

javaroast, thanks for the suggestion.