Re: Specifying more than one IP address per rule

[Mike Wright <xktnniuymlla@mailinator.com>]

Dan Purcell wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Is there a way (such as an iptables match) that allows one to specify
> more than one IP address for one rule?  I have in mind something like
> the multiport patch -- allowing the user to specify multiple tcp / udp
> ports per rule.  For example, I have the following ruleset that I would
> like to convert into one rule:
>
> iptables -N BADGUYS
> iptables -A BADGUYS -s 192.168.10.1    -j RETURN # 192.168.10.1 not bad
> iptables -A BADGUYS -s 192.168.10.0/24 -j DROP
> iptables -A BADGUYS -s 192.168.11.2    -j DROP
> iptables -A BADGUYS -s 192.168.11.3    -j DROP
> iptables -A BADGUYS -s 192.168.11.6    -j DROP
>
> I would like something like
>
> iptables -A BADGUYS -m multiip --srclist
> [!192.168.10.1,192.168.10.0/24,192.168.11.2,192.168.11.3,192.168.11.6]
> - -j DROP
I've had very good success using the ipset patch to iptables.  It allows 
you to use a single iptables rule to refer a named set of ips or nets, 
etc.  The set can then be updated on the fly without having to mess with 
your iptables rules.
hth, :m)