iptables: source range

Carlee · 08-29-2003, 01:41 PM

How should I specify the source to be blocked when it is a range?

Examples: 219.154.00 through 219.157.255.255
or 218.2.0.0 through 218.2.15.255.

Is there a better way to exclude all users of ChinaNet?

Thanks.

Looking_Lost · 08-29-2003, 05:47 PM

Put a hyphen inbetween 'em

219.154.00-219.157.255.255

Don't know of any other practical way to do what you want to

Carlee · 08-29-2003, 06:28 PM

A hyphen generates an error when entered:

"iptables v. 1.2.8: host/network '210.154.00-219.157.255.255' not found"

A forward slash doesn't work either (It's saved, but doesn't block the range.)

Thanks for thinking about this.

Looking_Lost · 08-29-2003, 06:37 PM

I've a cut 'n' paste typing error there

210.154.00.00-219.157.255.255

Does that make any difference, if not maybe can only do ranges in the same network range

Carlee · 08-29-2003, 06:55 PM

Doesn't work.

(I'd typed right when I tested, just skipped the decimal here. Sorry.)

What do you mean by "same network range"? Would there be some way to break the full range into several entries?

Also, 'man iptables' had something I didn't understand about masking. Is that relevant?

I haven't been able to find anything searching. This is beginning to look harder than it should be.

Looking_Lost · 08-29-2003, 07:03 PM

That's what I was thinking about when I mentioned network range, you'll have a few more entries, one line and rule for each but

210.154.0.0/16
211.0.0.0/8
212.0.0.0/8
....
219.157.0.0/16

that sort of thing.

Carlee · 08-29-2003, 08:23 PM

Does the "/16" mean that the address is interpreted as everything beginning with 210.154, going to 210.154.155.155? "Masking" the last two groups of numbers?

Why "16?"

To designate the range 218.2.0.0 to 218.2.15.255, would it be "218.2.1.0/4" (with 15 related entries) ?

ppuru · 08-31-2003, 04:19 AM

It cannot be 218.2.0.0/4.

It can be 218.2.0.0/16 but that will allow add the address from
218.2.0.0 to 218.2.255.255. As you only want IPs from 218.2.0.0 thru 218.2.15.255, it mmust be 218.2.0.0/20.

Carlee · 09-01-2003, 01:38 PM

Thanks for your help.

iptables is now blocking 100% of ChinaNet, about 1,000/day.