Date: Tue, 28 Oct 2014 08:30:49 +0000 From: "Spenst, Aleksej" <Aleksej.Spenst@harman.com> To: Adam McDougall <mcdouga9@egr.msu.edu>, "freebsd-pf@freebsd.org" <freebsd-pf@freebsd.org> Subject: AW: How to block IP range Message-ID: <CBA35483CE5B4D4B804BF128A77A61650E9A183E@HIKAWSEXMB02.ad.harman.com> In-Reply-To: <544E7883.1000705@egr.msu.edu> References: <CBA35483CE5B4D4B804BF128A77A61650E9A16A7@HIKAWSEXMB02.ad.harman.com> <544E7883.1000705@egr.msu.edu>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi Adam,
> From the manpage in 10:
> Ranges of addresses are specified by using the '-' operator. For
> instance: "10.1.1.10 - 10.1.1.12" means all addresses from 10.1.1.10 to 1=
0.1.1.12, hence addresses 10.1.1.10, 10.1.1.11, and 10.1.1.12.
It's interesting that when I write this rule in pf.conf:
block in quick on eth0 from "10.0.0.1 - 10.0.0.100" to 10.0.0.0
and load the rules then pfctl does not complain about any syntax errors.
However, if I look what rules are loaded with "pfctl -s rules" then I see o=
nly:
block drop in quick on eth0 inet from 10.0.0.1 to 10.0.0.0
So, it seems that my pfctl takes only the first address from the range and =
generates only 1 rule for this IP. Hmm...
Thanks,
Aleksej.
-----Urspr=FCngliche Nachricht-----
Von: owner-freebsd-pf@freebsd.org [mailto:owner-freebsd-pf@freebsd.org] Im =
Auftrag von Adam McDougall
Gesendet: Montag, 27. Oktober 2014 17:53
An: freebsd-pf@freebsd.org
Betreff: Re: How to block IP range
On 10/27/2014 12:11, Spenst, Aleksej wrote:
> Hi All,
>=20
> Is there any syntax to block a certain IP range?
> For example, I need to block only 100 IPs in the range:=20
> 10.0.0.1-10.0.0.100 I can't use the netmask like "block on eth0 from 10.0=
.0/24" since this will block 256 addresses.
> I don't want also to write all IPs separated by comma like "block on eth0=
from {10.0.0.1,10.0.0.2,.....}" since this will generate 100 separate rule=
s (and this is also a very long rule).
> Are there any other ways?
>=20
> Thank you!
> Aleksej.
>=20
>=20
>=20
>From the manpage in 10:
Ranges of addresses are specified by using the '-' operator. For
instance: "10.1.1.10 - 10.1.1.12" means all addresses from 10.1.1.10 to 10.=
1.1.12, hence addresses 10.1.1.10, 10.1.1.11, and 10.1.1.12.
_______________________________________________
freebsd-pf@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to "freebsd-pf-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CBA35483CE5B4D4B804BF128A77A61650E9A183E>