5

I have an existing iptables setup that does port forwarding. In this port forwarding scenario there are some instances where I do not want it to port forward. So, for instance I have this defined:

iptables -A PREROUTING -t nat -i eth0 '!' -s 10.200.0.0/16 -p tcp --dport 80 -j DNAT --to 10.200.30.11

This will prevent 10.200/16 from accessing this rule. As it turns out, I need to add multiple exclusions. However, there does not seem to be a way to do this:

iptables -A PREROUTING -t nat -i eth0 '!' -s 10.200.0.0/16,192.168.0.0/16 -p tcp --dport 8080 -j DNAT --to 10.200.30.11:80
iptables v1.4.8: ! not allowed with multiple source or destination IP addresses

I'm going to assume I have to approach this differently, but I do not know how. Any suggestions?

  • Can you not add a rule that DROP's based on a positive match of the criteria earlier in the chain? – Bratchley Apr 2 '13 at 18:50
  • Not to mix words.. but I don't want to literally "drop" anything. The packet still needs to be managed by the firewall. A packet could come from the internet (follow NAT rules), or from an ipsec connection (do not follow NAT rules) – jagauthier Apr 2 '13 at 19:10
7

You could use one of the following variants:

First one is ipset with set type "hash:net".

Second one is a iptables rule chain with -j RETURN for each network to skip check, and the desired default action as the last chain rule.

Third one is to mark packet with some bit flag using -j MARK and corresponding flag playing (with --set-mark, --set-xmark, etc.), and then to do the desired action if mark check is satisfied (-m mark and --mark). This is the most generic variant, because mark could be set in one table and checked in another one. OTOH the mark bitmask is limited to 32 bits, that could be not enough for complex rules.

  • Thanks. I looked into -j RETURN, but I couldn't figure out how to apply it. – jagauthier Apr 2 '13 at 19:28
  • -j RETURN.... GENIUS! – Davide Berra Jul 31 '13 at 11:01
0

If your IPs are ordered in sequence, for example:

1.1.1.5,1.1.1.6,1.1.1.7...,

you can use --src-range and specify first and last IPs of the sequence. For example, if I need to close 8020 port for all IPs but 1.1.1.[5-8], I need to add such iptables rule:

-A INPUT -p tcp -m iprange ! --src-range 1.1.1.5-1.1.1.8 -m tcp --dport 8020 -j DROP

Don't forget to use -m iprange with --src-range.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.