From owner-freebsd-pf@FreeBSD.ORG Tue Oct 28 08:37:54 2014 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id A4AD13B4 for ; Tue, 28 Oct 2014 08:37:54 +0000 (UTC) Received: from mail1.bemta5.messagelabs.com (mail1.bemta5.messagelabs.com [195.245.231.137]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "mail1.bemta5.messagelabs.com", Issuer "VeriSign Class 3 International Server CA - G3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 172B88A5 for ; Tue, 28 Oct 2014 08:37:53 +0000 (UTC) Received: from [85.158.139.51] by server-1.bemta-5.messagelabs.com id 42/A8-02954-D345F445; Tue, 28 Oct 2014 08:30:53 +0000 X-Env-Sender: Aleksej.Spenst@harman.com X-Msg-Ref: server-14.tower-180.messagelabs.com!1414485052!35987071!1 X-Originating-IP: [194.121.90.173] X-StarScan-Received: X-StarScan-Version: 6.12.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 22201 invoked from network); 28 Oct 2014 08:30:53 -0000 Received: from unassigned (HELO HIKAWSEXHC03.ad.harman.com) (194.121.90.173) by server-14.tower-180.messagelabs.com with AES128-SHA encrypted SMTP; 28 Oct 2014 08:30:53 -0000 Received: from HIKAWSEXMB02.ad.harman.com ([169.254.2.176]) by HIKAWSEXHC03.ad.harman.com ([172.16.1.113]) with mapi id 14.03.0195.001; Tue, 28 Oct 2014 09:30:50 +0100 From: "Spenst, Aleksej" To: Adam McDougall , "freebsd-pf@freebsd.org" Subject: AW: How to block IP range Thread-Topic: How to block IP range Thread-Index: Ac/yAK0p7fXyWmHOQQKNl9Uxk8B7f///+uuA//7rMUA= Date: Tue, 28 Oct 2014 08:30:49 +0000 Message-ID: References: <544E7883.1000705@egr.msu.edu> In-Reply-To: <544E7883.1000705@egr.msu.edu> Accept-Language: de-DE, en-US Content-Language: de-DE X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [172.16.102.147] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Oct 2014 08:37:54 -0000 Hi Adam, > From the manpage in 10: > Ranges of addresses are specified by using the '-' operator. For > instance: "10.1.1.10 - 10.1.1.12" means all addresses from 10.1.1.10 to 1= 0.1.1.12, hence addresses 10.1.1.10, 10.1.1.11, and 10.1.1.12. It's interesting that when I write this rule in pf.conf: block in quick on eth0 from "10.0.0.1 - 10.0.0.100" to 10.0.0.0 and load the rules then pfctl does not complain about any syntax errors. However, if I look what rules are loaded with "pfctl -s rules" then I see o= nly: block drop in quick on eth0 inet from 10.0.0.1 to 10.0.0.0 So, it seems that my pfctl takes only the first address from the range and = generates only 1 rule for this IP. Hmm... Thanks, Aleksej. -----Urspr=FCngliche Nachricht----- Von: owner-freebsd-pf@freebsd.org [mailto:owner-freebsd-pf@freebsd.org] Im = Auftrag von Adam McDougall Gesendet: Montag, 27. Oktober 2014 17:53 An: freebsd-pf@freebsd.org Betreff: Re: How to block IP range On 10/27/2014 12:11, Spenst, Aleksej wrote: > Hi All, >=20 > Is there any syntax to block a certain IP range? > For example, I need to block only 100 IPs in the range:=20 > 10.0.0.1-10.0.0.100 I can't use the netmask like "block on eth0 from 10.0= .0/24" since this will block 256 addresses. > I don't want also to write all IPs separated by comma like "block on eth0= from {10.0.0.1,10.0.0.2,.....}" since this will generate 100 separate rule= s (and this is also a very long rule). > Are there any other ways? >=20 > Thank you! > Aleksej. >=20 >=20 >=20 >From the manpage in 10: Ranges of addresses are specified by using the '-' operator. For instance: "10.1.1.10 - 10.1.1.12" means all addresses from 10.1.1.10 to 10.= 1.1.12, hence addresses 10.1.1.10, 10.1.1.11, and 10.1.1.12. _______________________________________________ freebsd-pf@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-pf To unsubscribe, send any mail to "freebsd-pf-unsubscribe@freebsd.org"