On 2012/08/08 16:01, Bill Shirley wrote:
On 8/8/2012 5:56 AM, Jatin K wrote:
Dear all,
is there any way or method available to configure iptables to allow only dhcp
server assigned ip , means if user manually sets his/her systems ip address
then Linux gateway(FC16) should reject it .
user must use the ip address which is assigned by dhcp, ( dhcp server is
running on the same machine where iptables are installed, and machine is
acting as a gateway )
Warm Regards
Put this in your dhcpd.conf to record the IP address issue in an ipset:
on commit {
set ClientIP = binary-to-ascii(10, 8, ".", leased-address);
# set ClientMac = binary-to-ascii(16, 8, ":", substring(hardware,
1, 6));
set ClientLeaseTime = binary-to-ascii(10, 32, "",
encode-int(lease-time, 32));
# set ClientLeaseTime = encode-int(lease-time, 32);
# set ClientLeaseTime = "14400";
execute (
"/usr/sbin/ipset",
"-A", "DHCPuser",
concat (ClientIP, ",", ClientLeaseTime)
);
}
You'll probably have to change the execute command to work with the new syntax
of ipset.
Then use the functionality of iptables to use the ipset to allow/deny access. I
use Shorewall for my firewall which makes it pretty easy.
Bill
What do you do about the fellow who simply hits the power switch or
disconnects the network cable?
{^_^}
--
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org
