Dan Purcell wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Is there a way (such as an iptables match) that allows one to specify more than one IP address for one rule? I have in mind something like the multiport patch -- allowing the user to specify multiple tcp / udp ports per rule. For example, I have the following ruleset that I would like to convert into one rule: iptables -N BADGUYS iptables -A BADGUYS -s 192.168.10.1 -j RETURN # 192.168.10.1 not bad iptables -A BADGUYS -s 192.168.10.0/24 -j DROP iptables -A BADGUYS -s 192.168.11.2 -j DROP iptables -A BADGUYS -s 192.168.11.3 -j DROP iptables -A BADGUYS -s 192.168.11.6 -j DROP I would like something like iptables -A BADGUYS -m multiip --srclist [!192.168.10.1,192.168.10.0/24,192.168.11.2,192.168.11.3,192.168.11.6] - -j DROP
I've had very good success using the ipset patch to iptables. It allows you to use a single iptables rule to refer a named set of ips or nets, etc. The set can then be updated on the fly without having to mess with your iptables rules.
hth, :m)
