0

WINPE1 = 192.168.10.5 iptables -A INPUT -p tcp -s 192.168.10.5 --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 80 -j DROP

iptables -A INPUT -s 192.168.10.5 -p ICMP --icmp-type 8 -j ACCEPT iptables -A INPUT -p ICMP --icmp-type 8 -j DROP

I have written this rules in response to these guidelines • Only allow HTTPD traffic from WINPE1. Use an ACCEPT command. We are implementing a DROP policy. • Allow Ping traffic from WINPE1 only. Again use an ACCEPT command.

However in the guidelines it is stated that Subnet addressing (like 192.160.10.0/24 for example) must be used throughout the firewall, no individual IP addresses allowed for source machines and no specified ranges allowed either e.g. --src-range 192.168.1.100-192.168.1.200. How do I change the 192.168.10.5 address to cidr notation without granting access to other ip addresses?

  • 3
    I've never seen 192.160.10.0\24 used, why the backslash instead of a forward slash? – thrig Nov 21 '18 at 20:31
2

iptables is able to handle networks realy easy. In your case:

iptables -A INPUT -p tcp -s 192.168.10.0/24 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -s 192.168.10.0/24 -p ICMP --icmp-type 8 -j ACCEPT
iptables -A INPUT -p ICMP --icmp-type 8 -j DROP

Or instead of 192.168.10.0/24 you can use 192.168.10.0/255.255.255.0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.