How to block IP range

[Chris H]

On Mon, 27 Oct 2014 16:37:43 +0000 Gary Palmer <gpalmer at freebsd.org> wrote

> On Mon, Oct 27, 2014 at 05:30:57PM +0100, Cristiano Deana wrote:
> > On Mon, Oct 27, 2014 at 5:24 PM, Gary Palmer <gpalmer at freebsd.org> wrote:
> > 
> > Hi
> > 
> > >> For example, I need to block only 100 IPs in the range:
> > >> 10.0.0.1-10.0.0.100 > 
> > > tables?
> > >
> > > you can do things like
> > >
> > > table <blocked_hosts> persist file "/etc/pf/blocked_hosts.table"
> > > block in quick log on $ext_if_ipv4 from <blocked_hosts> to any
> > 
> > I'm adding the fast way to build the file:
> > 
> > sh -c 'for ip in 'jot 100 1 100'; do echo 10.0.0.$ip >>
> > /etc/pf/blocked_hosts.table; done'
> 
> You can also make it a bit more efficient and use a few CIDR networks.  To
> cover 10.0.0.1-10.0.0.100 you would need.
> 
>           10.0.0.1/32
>           10.0.0.2/31
>           10.0.0.4/30
>           10.0.0.8/29
>          10.0.0.16/28
>          10.0.0.32/27
>          10.0.0.64/27
>          10.0.0.96/30
>         10.0.0.100/32
> 
> I used an ancient perl tool called 'aggis' to get the above.  There are
> probably more modern tools around.
A search against ports, or at FreshPorts for cidr will give you quite
a few useful utils for calculating /xx (CIDR) ranges. ports/net-mgmt/cidr
is just one example.

HTH

--Chris

> 
> Regards,
> 
> Gary
> _______________________________________________
> freebsd-pf at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-pf
> To unsubscribe, send any mail to "freebsd-pf-unsubscribe at freebsd.org"