Re: Iptables generic broadcast filter
You are all right, I must have thought on this before
sending this question..
Thanks
alex
On Wed, 2002-11-13 at 16:12, Matthew Kirkwood wrote:
> On 13 Nov 2002, Alex Ongena wrote:
>
> > I want to drop all broadcasts on INPUT in a generic way
> > without knowing in advance on which subnet/netmask my
> > appliance is.
>
> > # iptables -A INPUT -d *.*.*.255 -j DROP
> > # iptables -A INPUT -d *.*.255.255 -j DROP
> > # iptables -A INPUT -d *.255.255.255 -j DROP
> >
> > where * is a wildcard matching any ip.
>
> Yes. Netmasks don't need to be contiguous or MSB-aligned:
>
> # iptables -A INPUT -d 0.0.0.255/0.0.0.255 -j DROP
>
> will drop anything with an all-ones LSO.
>
> Matthew.
>
>
> --
> To UNSUBSCRIBE, email to debian-firewall-request@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
>
Reply to: