{"id":4516,"date":"2014-11-19T15:51:00","date_gmt":"2014-11-19T13:51:00","guid":{"rendered":"http:\/\/skeletor.org.ua\/?p=4516"},"modified":"2017-01-23T11:12:59","modified_gmt":"2017-01-23T09:12:59","slug":"ip-range-in-firewalls","status":"publish","type":"post","link":"https:\/\/skeletor.org.ua\/?p=4516","title":{"rendered":"IP range in firewalls"},"content":{"rendered":"

PF<\/span><\/strong><\/h2>\n

# grep test \/etc\/pf.conf
\ntest=\"{ 10.0.0.1 - 10.0.0.100 }\"
\nblock in quick on $ext_if from $test
\n# pfctl -nvf \/etc\/pf.conf | grep 10.0
\ntest = \"{ 10.0.0.1 - 10.0.0.100 }\"
\nblock drop in quick on em1 inet from 10.0.0.1 - 10.0.0.100 to any<\/code><\/p>\n

\u041d\u043e \u0443 \u043c\u0435\u043d\u044f \u043d\u0435 \u0432\u0441\u0435\u0433\u0434\u0430 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u0441\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u043b\u043e \u044d\u0442\u043e \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u043d\u0430 FreeBSD<\/strong>.<\/p>\n

iptables<\/span><\/strong><\/h2>\n

iptables -A INPUT -p tcp --destination-port 22 -m iprange --src-range 192.168.1.100-192.168.1.200 -j ACCEPT
\niptables -t nat -A POSTROUTING -j SNAT --to-source 192.168.1.100-192.168.1.200<\/code><\/p>\n

\u0412 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u0435\u0440\u0432\u043e\u043b\u0430\u0445 (ipfilter<\/strong>) \u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u0430 \u043d\u0435\u0442 \u0438 \u043f\u0440\u0438\u0434\u0451\u0442\u0441\u044f \u0440\u0430\u0437\u0431\u0438\u0432\u0430\u0442\u044c \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d \u043d\u0430 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 CIDR<\/strong>.<\/p>\n

ipfw<\/strong><\/span><\/h2>\n

ipfw add allow all from\u00a01.2.3.0\/24{128,35-55,89}<\/code><\/p>\n

\u0412\u044b\u0434\u0435\u0440\u0436\u043a\u0430 \u0438\u0437 \u043c\u0430\u043d\u0430:<\/p>\n

As an example, an address specified as 1.2.3.4\/24{128,35-55,89}<\/span>
\n or 1.2.3.0\/24{128,35-55,89} will match the following IP<\/span>
\n addresses:<\/span>
\n 1.2.3.128, 1.2.3.35 to 1.2.3.55, 1.2.3.89 .<\/span><\/p><\/blockquote>\n

\u0421\u043f\u0430\u0441\u0438\u0431\u043e \u043d\u0430\u0448\u0435\u043c\u0443 \u0447\u0438\u0442\u0430\u0442\u0435\u043b\u044e, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u043b \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u0440\u043e ipfw<\/strong>.<\/p>\n

\u0415\u0441\u043b\u0438 \u0443 \u043a\u043e\u0433\u043e-\u0442\u043e \u043d\u0435 \u0437\u0430\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u043e, \u0432\u043e\u0442 \u0441\u0441\u044b\u043b\u043a\u0430<\/a> \u043d\u0430 \u0440\u0430\u0437\u0431\u0438\u0432\u043a\u0443 \u043d\u0430 \u043f\u043e\u0434\u0441\u0435\u0442\u0438<\/p>\n","protected":false},"excerpt":{"rendered":"

PF # grep test \/etc\/pf.conf test=”{ 10.0.0.1 – 10.0.0.100 }” block in quick on $ext_if from $test # pfctl -nvf \/etc\/pf.conf | grep 10.0 test = “{ 10.0.0.1 – 10.0.0.100 }” block drop in quick on em1 inet from 10.0.0.1 – 10.0.0.100 to any \u041d\u043e \u0443 \u043c\u0435\u043d\u044f \u043d\u0435 \u0432\u0441\u0435\u0433\u0434\u0430 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u0441\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u043b\u043e \u044d\u0442\u043e \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u043d\u0430 FreeBSD. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,5,25],"tags":[],"class_list":["post-4516","post","type-post","status-publish","format-standard","hentry","category-freebsd","category-linux","category-openbsd"],"_links":{"self":[{"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/posts\/4516","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4516"}],"version-history":[{"count":8,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/posts\/4516\/revisions"}],"predecessor-version":[{"id":5113,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/posts\/4516\/revisions\/5113"}],"wp:attachment":[{"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4516"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4516"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4516"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}