Date: Mon, 27 Oct 2014 16:24:33 +0000 From: Gary Palmer <gpalmer@freebsd.org> To: "Spenst, Aleksej" <Aleksej.Spenst@harman.com> Cc: "freebsd-pf@freebsd.org" <freebsd-pf@freebsd.org> Subject: Re: How to block IP range Message-ID: <20141027162433.GB6851@in-addr.com> In-Reply-To: <CBA35483CE5B4D4B804BF128A77A61650E9A16A7@HIKAWSEXMB02.ad.harman.com> References: <CBA35483CE5B4D4B804BF128A77A61650E9A16A7@HIKAWSEXMB02.ad.harman.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Oct 27, 2014 at 04:11:33PM +0000, Spenst, Aleksej wrote:
> Hi All,
>
> Is there any syntax to block a certain IP range?
> For example, I need to block only 100 IPs in the range: 10.0.0.1-10.0.0.100
> I can't use the netmask like "block on eth0 from 10.0.0/24" since this will block 256 addresses.
> I don't want also to write all IPs separated by comma like "block on eth0 from {10.0.0.1,10.0.0.2,.....}" since this will generate 100 separate rules (and this is also a very long rule).
> Are there any other ways?
tables?
you can do things like
table <blocked_hosts> persist file "/etc/pf/blocked_hosts.table"
block in quick log on $ext_if_ipv4 from <blocked_hosts> to any
Regards,
Gary
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20141027162433.GB6851>