Iptables problems

[tvlad]

If i want to block a range of ip's, how do i put it :

 

iptables -A input -i eth1 -s 192.168.0-255.0-255 -d 0/0 -j DROP

iptables -A input -i eth1 -s 192.168.0.101:192.168.255.255 -d 0/0 -j DROP

 

because i tried like that and it didn't work.

 

And one more thing, i want to block by mac adress:

 

iptables -A INPUT -i eth1 --mac-source 00:40:F4:4B:35:3C -d 0/0 -j DROP

 

is there smth wrong to it, because iptables says unknown arg --mac-source.

[aru]

If i want to block a range of ip's, how do i put it :

 

iptables -A input -i eth1 -s 192.168.0-255.0-255 -d 0/0 -j DROP

iptables -A input -i eth1 -s 192.168.0.101:192.168.255.255 -d 0/0 -j DROP

 

because i tried like that and it didn't work.

 

This is more or less how I did what I think that you want to do (I use a isdn interface):

 

--notice the syntax--

#!/bin/sh

#/etc/sysconfig/iptables



<...snip...>



EXTERNAL_INTERFACE="ippp0"



<...snip...>



CLASS_A="10.0.0.0/8"

CLASS_B="172.16.0.0/12"

CLASS_C="192.168.0.0/16"



<...snip...>



# Protect against IP *robery*

for f in /proc/sys/net/ipv4/conf/{tcp_syncookies,ip_forward,*/rp_filter}

do

       echo 1 > $f

done



<... snip ...>

           

# Drop *internet* packages that say they come or go to private addresses

iptables -A INPUT  -i $EXTERNAL_INTERFACE -s $CLASS_A -j DROP

iptables -A INPUT  -i $EXTERNAL_INTERFACE -s $CLASS_B -j DROP

iptables -A INPUT  -i $EXTERNAL_INTERFACE -s $CLASS_C -j DROP

iptables -A INPUT  -i $EXTERNAL_INTERFACE -d $CLASS_A -j DROP

iptables -A INPUT  -i $EXTERNAL_INTERFACE -d $CLASS_B -j DROP

iptables -A INPUT  -i $EXTERNAL_INTERFACE -d $CLASS_C -j DROP

iptables -A OUTPUT -o $EXTERNAL_INTERFACE -s $CLASS_A -j DROP

iptables -A OUTPUT -o $EXTERNAL_INTERFACE -s $CLASS_B -j DROP

iptables -A OUTPUT -o $EXTERNAL_INTERFACE -s $CLASS_C -j DROP

iptables -A OUTPUT -o $EXTERNAL_INTERFACE -d $CLASS_A -j DROP

iptables -A OUTPUT -o $EXTERNAL_INTERFACE -d $CLASS_B -j DROP

iptables -A OUTPUT -o $EXTERNAL_INTERFACE -d $CLASS_C -j DROP



<...snip...>

 

HTH

© CAUP (campaing against unanswered posts)

[tvlad]

I finally figured how to block by mac-address

 

$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -m mac --mac-source 00:20:ED:50:A3:AA -d $UNIVERSE -j DROP

 

Now, aru, are u sure that for 172.16.0.0, to cover the hole range of ip's u must put a /12, i understand why /16 for 192.168, why /8 for 10.0 , but not why /12 for 172.16.

[aru]

Now, aru, are u sure that for 172.16.0.0, to cover the hole range of ip's u must put a /12, i understand why /16 for 192.168, why /8 for 10.0 , but not why /12 for 172.16.

 

Because the range of reserved IPs to protect is 172.16.0.0 to 172.31.255.255, and not just 172.16.0.0 to 172.16.255.255.

 

This works as:

- Class A: XXX.abc.abc.abc

- Class B: XXX.YYY.abc.abc

- Class C: XXX.YYY.ZZZ.abc

 

8 bits = 1 byte so the 1st octect if fixed the other 3 changes (Class A)

16 bits = 2 bytes so the 1st and the 2nd octect are fixed the other 2 changes (Class B)

24 bits = 3 bytes so the all octects are fixed except the last one (Class C)

32 bits = all octects are fixed (single IP).

12 bits = 1 byte + 4 bits; it is a type of Class B where the 2nd octect can be between 16 and 32.

[tvlad]

Yup, silly/stupid me.

[hilbert]

For those who are interested in iptables, NAT and IP redirection are common services. How is the scripts in http://sourceforge.net/project/shownotes.p...lease_id=128663 ?

[aru]

I've checked only the nat.sh one, and it doesn't give me very good feelings, seems to be not in a productive status. It doesn't handle errors at all (for example, running it as "nat.sh foo bar" is perfectly possible), and a whole "confirm" code section (important for those who will try to run the script without knowing exactly what they are doing --many cases--) is commented out.

 

Also, IMHO, the job that it does can be easily achieved editing by hand a couple of lines at your own iptables script w/o disabling all your current rules.

 

While it seems to do what it has to do, I wouldn't put it in my /sbin directory in its current status.

 

Sorry hilbert, but all is just in MHO. :D

 

BTW, you should have started a new thead on tips&tricks or here in Networking because your scripts could be of interest for many users.