0

Update Jun 30 I have a list of ips.txt and I want iptables accepts any ip or range in any format. Example:

# IPs List
199.59.243.120
157.60.1.0/24
91.190.0.0/16
192.168.2.1-192.168.2.25

My rule:

for ip in $(sed '/#.*/d' ips.txt); do
   if echo $ip | grep -q "-" >/dev/null; then
     iptables -w -A FORWARD -i eth1 -p tcp --dport 80 -m iprange --dst-range "$ip" -j ACCEPT
   else
     iptables -w -A FORWARD -i eth1 -p tcp --dport 80 -d $ip -j ACCEPT
   fi
done

Iptables accept the ip 199.59.243.120 and the range 192.168.2.1-192.168.2.25, but how to get iptables accept the range 157.60.1.0/24 or 91.190.0.0/16???

Thanks

  • for range to work , you cant give it a network address , but u need to give it a range like 157.60.1.1-157.60.1.254. therefore , first convert all the CIDR formates to ranges like that and then run it. – Ijaz Ahmad Khan Jun 30 '16 at 16:19
  • I updated the question for clarity. – user167531 Jun 30 '16 at 16:55
1

As iptables -d accepts networks in CIDR notation, you can probably just change your grep to finding ranges specified with a - and then swap your commands (or negate the result from grep).

  • I updated the question for clarity. – user167531 Jun 30 '16 at 16:55
0

157.60.1.0/24 lies in else condition like -d 157.60.1.0/24 -j Accept.It do not fit in first condition --dst-range as the error says. So command is echo $ ip l grep -q "-"

  • I updated the question for clarity. – user167531 Jun 30 '16 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy