Hello!

Just today I have required the use of IPTABLES and with google I found an excellent site (http://www.justlinux.com/nhf/Securit...es_Basics.html) that was very straight forward and understandable.

I have a problem now though because the IP I wish to drop is not static. However, it is always 151.203.*.* and so I would like to add that as a rule.

Although... the tutorial I learned from seems to hint that using * is not acceptable. This is what it says:

"If you wanted to specify a range of IP's, you could use 200.200.200.0/24. This would specify any IP that matched 200.200.200.*."

Does this mean I could use 151.203.0/24.0/24 to get the results I wanted? I have just become quite confused because the 0/24 looks very foreign to me and I cannot comprehend the explanation behind the syntax and the value of the integer.

I guess I just really wanna understand why and make sure I am going to be doing it right.


Thank you so much for your help, it is greatly appreciated.

-Chi

If you are wanting to block 151.203.*.* you can use 151.203.0.0/16

Alright, thanks for the reply.

I will give that a try and I guess look for stuff on subnetting or whatever its called

-Chi

Actually I have another question to add...

iptables aside, If I were to be choosing to block an ip range..

would selecting 151.203.0.0 with a subnet of 255.255.0.0 be the same as the 151.203.0.0/16 ??

or is this more of a network question, maybe i should ask it there

Thanks again..

-Chi

yes 151.203.0.0/255.255.0.0 151.203.0.0/16 both the same, I pretty sure iptables will accept either.

chibi:
The form "151.203.0.0/16" is called CIDR notation.

See:
http://wiki.linuxquestions.org/wiki/CIDR_notation

here's another link you might wanna look at to understand the subnetting concept a little better: http://en.wikipedia.org/wiki/Subnetwork

BTW, there's also a patch you can use if you want to be able to specify actual ip ranges (instead of just subnets)... this is useful for situations in which matching an entire subnet is not an option... a rule might look like, for example:just my $0.02...