From owner-freebsd-pf@FreeBSD.ORG  Mon Oct 27 16:24:41 2014
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 0F2D0B3F;
 Mon, 27 Oct 2014 16:24:41 +0000 (UTC)
Received: from mail.in-addr.com (mail.in-addr.com
 [IPv6:2a01:4f8:191:61e8::2525:2525])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id C6ACDE32;
 Mon, 27 Oct 2014 16:24:40 +0000 (UTC)
Received: from gjp by mail.in-addr.com with local (Exim 4.84 (FreeBSD))
 (envelope-from <gpalmer@freebsd.org>)
 id 1Xin5t-0002fb-Cd; Mon, 27 Oct 2014 16:24:33 +0000
Date: Mon, 27 Oct 2014 16:24:33 +0000
From: Gary Palmer <gpalmer@freebsd.org>
To: "Spenst, Aleksej" <Aleksej.Spenst@harman.com>
Subject: Re: How to block IP range
Message-ID: <20141027162433.GB6851@in-addr.com>
References: <CBA35483CE5B4D4B804BF128A77A61650E9A16A7@HIKAWSEXMB02.ad.harman.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CBA35483CE5B4D4B804BF128A77A61650E9A16A7@HIKAWSEXMB02.ad.harman.com>
X-SA-Exim-Connect-IP: <locally generated>
X-SA-Exim-Mail-From: gpalmer@freebsd.org
X-SA-Exim-Scanned: No (on mail.in-addr.com); SAEximRunCond expanded to false
Cc: "freebsd-pf@freebsd.org" <freebsd-pf@freebsd.org>
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.18-1
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
 \(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf/>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 27 Oct 2014 16:24:41 -0000

On Mon, Oct 27, 2014 at 04:11:33PM +0000, Spenst, Aleksej wrote:
> Hi All,
> 
> Is there any syntax to block a certain IP range?
> For example, I need to block only 100 IPs in the range: 10.0.0.1-10.0.0.100
> I can't use the netmask like "block on eth0 from 10.0.0/24" since this will block 256 addresses.
> I don't want also to write all IPs separated by comma like "block on eth0 from {10.0.0.1,10.0.0.2,.....}" since this will generate 100 separate rules (and this is also a very long rule).
> Are there any other ways?

tables?

you can do things like

table <blocked_hosts> persist file "/etc/pf/blocked_hosts.table"
block in quick log on $ext_if_ipv4 from <blocked_hosts> to any

Regards,

Gary