On 8/8/2012 5:56 AM, Jatin K wrote:
Dear all,
is there any way or method available to configure iptables to allow
only dhcp server assigned ip , means if user manually sets his/her
systems ip address then Linux gateway(FC16) should reject it .
user must use the ip address which is assigned by dhcp, ( dhcp server
is running on the same machine where iptables are installed, and
machine is acting as a gateway )
Warm Regards
Put this in your dhcpd.conf to record the IP address issue in an ipset:
on commit {
set ClientIP = binary-to-ascii(10, 8, ".", leased-address);
# set ClientMac = binary-to-ascii(16, 8, ":",
substring(hardware, 1, 6));
set ClientLeaseTime = binary-to-ascii(10, 32, "",
encode-int(lease-time, 32));
# set ClientLeaseTime = encode-int(lease-time, 32);
# set ClientLeaseTime = "14400";
execute (
"/usr/sbin/ipset",
"-A", "DHCPuser",
concat (ClientIP, ",", ClientLeaseTime)
);
}
You'll probably have to change the execute command to work with the new
syntax of ipset.
Then use the functionality of iptables to use the ipset to allow/deny
access. I use Shorewall for my firewall which makes it pretty easy.
Bill
--
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org
