How would you format it if you want to drop a whole range or block of
IP addresses?
I made a utilty for myself which I call "ipblock". It handles whatever string I wish to enter whether it's IPv4 or IPv6, a single IP or a block. It writes to a file called /etc/blocked.ips which is then called upon bootup as part of my firewalling. In doing a whole block enter in the cidr shorthand. Ex:
/sbin/iptables -I INPUT -s 49.7.0.0/16 -j ROP
/sbin/iptables -I OUTPUT -d 49.7.0.0/16 -j DROP
/sbin/iptables -I FORWARD -s 49.7.0.0/16 -j DROP
This filters a scanbot block from my box. :)
Further questions, feel free to netmail me as this really isn't Bink information. I'll be happy to try and answer.
You can also add logging and such if you desire. I don't feel that if
I'm denying a block that I need to see my work did the job I
programmed it to do though.
Wilfred van Velzen wrote to Brian Rogers <=-
Or take it to the INTERNET and/or TCPIP areas, so we can all learn! ;)
| Sysop: | digital man |
|---|---|
| Location: | Riverside County, California |
| Users: | 1,029 |
| Nodes: | 17 (0 / 17) |
| Uptime: | 89:59:42 |
| Calls: | 504,185 |
| Calls today: | 7 |
| Files: | 155,737 |
| D/L today: |
78,048 files (18,113M bytes) |
| Messages: | 446,404 |
| Posted today: | 5 |