Date: Sun, 23 Mar 2014 10:00:14 -0500 From: "Matthew D. Fuller" <fullermd@over-yonder.net> To: Julian Elischer <julian@freebsd.org> Cc: ipfw@freebsd.org, Ian Smith <smithi@nimnet.asn.au> Subject: Re: ipfw dynamic rules Message-ID: <20140323150014.GE96701@over-yonder.net> In-Reply-To: <532EF401.80506@freebsd.org> References: <51546.1395432085@server1.tristatelogic.com> <20140322182402.Q83569@sola.nimnet.asn.au> <201403221454.IAA22021@mail.lariat.net> <20140322151155.184d5229@gumby.homeunix.com> <532E723C.2090109@freebsd.org> <532E7398.5090607@freebsd.org> <20140324000439.F87212@sola.nimnet.asn.au> <532EF401.80506@freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Mar 23, 2014 at 07:47:29AM -0700 I heard the voice of Julian Elischer, and lo! it spake thus: > > comments welcome (bugs expected) > > > /sbin/ipfw table add 13 0.0.0.0/8 > /sbin/ipfw table add 13 10.0.0.0/8 > /sbin/ipfw table add 13 169.254.0.0/16 > /sbin/ipfw table add 13 172.16.0.0/12 > /sbin/ipfw table add 13 192.0.2.0/24 > /sbin/ipfw table add 13 192.168.0.0/16 > /sbin/ipfw table add 13 224.0.0.0/4 > /sbin/ipfw table add 13 240.0.0.0/4 > > /sbin/ipfw add 2002 set 0 reject ip from any to table(13) Missing a couple martians, and this is a bit automatable. It's sh, after all. Out of the script on one of my servers: ---------------------- # A table for ipv4 martians # Source: http://www.team-cymru.org/Services/Bogons/bogon-bn-agg.txt # NOTE: Source file doesn't have terminating newline; be sure to add one! mtable="100" bogfile="${mydir}/bogon-bn-agg.txt" if [ -r "$bogfile" ]; then ${ipfw} table ${mtable} flush cat $bogfile | while read block ; do ${ipfw} table ${mtable} add ${block} ; done fi # ... lots of stuff elided # Ignore ${ipfw} add 1010 drop ip4 from table\(${mtable}\) to any ---------------------- Handy to just be able to randomly fetch(1) a new file and let the fw keep up. Though watch out for that lacking trailing newline; I've been left without 224.0.0.0/3 (save a slot, escew /4!) once or twice from forgetting. -- Matthew Fuller (MF4839) | fullermd@over-yonder.net Systems/Network Administrator | http://www.over-yonder.net/~fullermd/ On the Internet, nobody can hear you scream.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20140323150014.GE96701>