Ralph Blach wrote:
I want to log all drop packets but just pass some packets
I wrote these rules.
'
Will these test of rules allow all packets on the input of wlan allow
packets with source address in the 10.0.0.0/255.255.255.0
and drop/log the selected networks>
Thanks
Chip
/sbin/iptables -F
/sbin/iptables -N LOGDROP
/sbin/iptables -A LOGDROP -i wlan0 -j LOG --log-level 7
/sbin/iptables -A LOGDROP -j DROP
/sbin/iptables -A INPUT -i wlan -s 10.0.0.0/255.255.255.0 -j
RETURN #return
/sbin/iptables -A INPUT -i wlan -s 24.25.5.148 -j RETURN
/sbin/iptables -A INPUT -i wlan -s 24.25.5.147 -j RETURN
/sbin/iptables -A INPUT -i wlan0 -s 58.102.198.29/255.255.255.0 -j
LOGDROP # log and drop
you should really take more care to get your facts straight, imho. it's
not the first time you try to request on that issue...
you also should read the iptables tutorial:
http://www.frozentux.net/documents/iptables-tutorial/
still having a hard time to figure out what you want, this is my best guess:
#!/bin/bash
ipt=/sbin/iptables
if_wlan=wlan0
allow_net=10.0.0.0/24
allow_hosts="24.25.5.148 24.25.5.147"
# first set INPUT policy to DROP
$ipt -P INPUT DROP
# allow from allowed network
$ipt -A INPUT -i $if_wlan -s $allow_net -j ACCEPT
# allow from certain hosts
for host in ${allow_hosts}; do
$ipt -A INPUT -s $host -j ACCEPT
done
# log what is left, as the policy will drop it afterwards
$ipt -A INPUT -j LOG --log-level 7 --log-prefix "INPUT_POLICY_DROP: "
Regards
Mart
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
