[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: combining multiple ip's into one variable on iptables script?

On Wed, Jul 30, 2003 at 01:20:47PM +0100, Mark C wrote:

> i.e I use ftp.www.mirror.ac.uk
> running nslookup on this gives me multiple ip addresses, I could create
> a variable for each IP, i.e 
> and so forth, then create rules that allow outbound connections to each
> of theses sites, is it possible to combine them all into one variable,
> like

iptables only allows a single netblock per rule (where a netblock can be
as small as a single host when it's specified as /32). You have two
choices. You could specify ftp.www.mirror.ac.uk as 194.83.57/29, which
actually open up all hosts in the range of 194.873.57.0 to

Or you could change your iptables scripts so that they treat each host
variable as a list, and loop over the list:


 for host in $APT_MIRROR_AC_UK; do
   iptables -A block ... -s $host -j ACCEPT

This still would work correctly even if at a later date you changed
APT_MIRROR_AC_UK to only be a single host.

Dave Carrigan
Seattle, WA, USA
dave@rudedog.org | http://www.rudedog.org/ | ICQ:161669680

Reply to: