From owner-freebsd-questions@FreeBSD.ORG  Thu May 15 07:36:53 2003
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id F13D637B401
	for <freebsd-questions@freebsd.org>;
	Thu, 15 May 2003 07:36:52 -0700 (PDT)
Received: from sage-one.net (adsl-65-71-135-137.dsl.crchtx.swbell.net
	[65.71.135.137])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 3292A43F75
	for <freebsd-questions@freebsd.org>;
	Thu, 15 May 2003 07:36:52 -0700 (PDT)
	(envelope-from jackstone@sage-one.net)
Received: from sagea (adsl-65-68-247-73.dsl.crchtx.swbell.net [65.68.247.73])
	by sage-one.net (8.12.6p2/8.12.6) with SMTP id h4FEaY1v033229
	for <freebsd-questions@freebsd.org>;
	Thu, 15 May 2003 09:36:35 -0500 (CDT)
	(envelope-from jackstone@sage-one.net)
Message-Id: <3.0.5.32.20030515093637.013644e0@sage-one.net>
X-Sender: jackstone@sage-one.net
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.5 (32)
Date: Thu, 15 May 2003 09:36:37 -0500
To: freebsd-questions@freebsd.org
From: "Jack L. Stone" <jackstone@sage-one.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
X-Spam-Status: No, hits=0.8 required=4.5
	tests=SPAM_PHRASE_00_01
	version=2.44-sageamerules_v1
Subject: RedAlert.com firewall block
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 15 May 2003 14:36:53 -0000

A while back, I mentioned that everyday, one of my servers is being queried
multiple times by RedAlert.com, and not by our request. This has been going
on for a couple of months now and after notifying them that they should not
be monitoring our site, it has not stopped. So, it's time to block with the
firewall I suppose.

My question is, since the queries come from 14 RedAlert.com IPs, is there a
way to set up a range of the IPs to block rather than a blocking rule for
each IP...?? I imagine it would take a range for each of the two groups
below: 65.194.51.13X and 65.194.51.15X

These are the usual IPs found in the logs every day:
65.194.51.131
65.194.51.132
65.194.51.133
65.194.51.134
65.194.51.135
65.194.51.136
65.194.51.137
65.194.51.151
65.194.51.152
65.194.51.153
65.194.51.154
65.194.51.155
65.194.51.156
65.194.51.157

Appreciate any tips on this. Thanks!

Best regards,
Jack L. Stone,
Administrator

SageOne Net
http://www.sage-one.net
jackstone@sage-one.net