-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Do you have to use a userspace tool to set the sets of ip addresses? What is it called? Where can I get it? - -Dan Mike Wright wrote: > Dan Purcell wrote: >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> Is there a way (such as an iptables match) that allows one to specify >> more than one IP address for one rule? I have in mind something like >> the multiport patch -- allowing the user to specify multiple tcp / udp >> ports per rule. For example, I have the following ruleset that I would >> like to convert into one rule: >> >> iptables -N BADGUYS >> iptables -A BADGUYS -s 192.168.10.1 -j RETURN # 192.168.10.1 not bad >> iptables -A BADGUYS -s 192.168.10.0/24 -j DROP >> iptables -A BADGUYS -s 192.168.11.2 -j DROP >> iptables -A BADGUYS -s 192.168.11.3 -j DROP >> iptables -A BADGUYS -s 192.168.11.6 -j DROP >> >> I would like something like >> >> iptables -A BADGUYS -m multiip --srclist >> [!192.168.10.1,192.168.10.0/24,192.168.11.2,192.168.11.3,192.168.11.6] >> - -j DROP > > I've had very good success using the ipset patch to iptables. It allows > you to use a single iptables rule to refer a named set of ips or nets, > etc. The set can then be updated on the fly without having to mess with > your iptables rules. > > hth, :m) - -- - -------------------------------------------------------------- Dan Purcell, Software Engineer dpurcell@xxxxxxxxxxxxxxxxx NitroSecurity, Inc. (208) 552-5332 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFF/xT0Tqu8TzII/vURAswuAKCtvI69OGwoJ/R6T7yzfENzfFNYFACg3/aM m+kLwX1TifdIKbKnTeMD7aw= =As7F -----END PGP SIGNATURE-----
