IPTABLES CONFIGURATION CIDR notation
up vote
0
down vote
favorite
WINPE1 = 192.168.10.5
iptables -A INPUT -p tcp -s 192.168.10.5 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -s 192.168.10.5 -p ICMP --icmp-type 8 -j ACCEPT
iptables -A INPUT -p ICMP --icmp-type 8 -j DROP
I have written this rules in response to these guidelines
• Only allow HTTPD traffic from WINPE1. Use an ACCEPT command. We are implementing a DROP policy.
• Allow Ping traffic from WINPE1 only. Again use an ACCEPT command.
However in the guidelines it is stated that Subnet addressing (like 192.160.10.0/24 for example) must be used throughout the firewall, no individual IP addresses allowed for source machines and no specified ranges allowed either e.g. --src-range 192.168.1.100-192.168.1.200.
How do I change the 192.168.10.5 address to cidr notation without granting access to other ip addresses?
firewall
edited Nov 21 at 21:44
Community♦
1
asked Nov 21 at 20:19
abignetworknoob
1
New contributor
abignetworknoob is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
up vote
0
down vote
favorite
WINPE1 = 192.168.10.5
iptables -A INPUT -p tcp -s 192.168.10.5 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -s 192.168.10.5 -p ICMP --icmp-type 8 -j ACCEPT
iptables -A INPUT -p ICMP --icmp-type 8 -j DROP
I have written this rules in response to these guidelines
• Only allow HTTPD traffic from WINPE1. Use an ACCEPT command. We are implementing a DROP policy.
• Allow Ping traffic from WINPE1 only. Again use an ACCEPT command.
However in the guidelines it is stated that Subnet addressing (like 192.160.10.0/24 for example) must be used throughout the firewall, no individual IP addresses allowed for source machines and no specified ranges allowed either e.g. --src-range 192.168.1.100-192.168.1.200.
How do I change the 192.168.10.5 address to cidr notation without granting access to other ip addresses?
firewall
edited Nov 21 at 21:44
Community♦
1
asked Nov 21 at 20:19
abignetworknoob
1
New contributor
abignetworknoob is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
3
I've never seen192.160.10.024used, why the backslash instead of a forward slash?
– thrig
Nov 21 at 20:31
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
WINPE1 = 192.168.10.5
iptables -A INPUT -p tcp -s 192.168.10.5 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -s 192.168.10.5 -p ICMP --icmp-type 8 -j ACCEPT
iptables -A INPUT -p ICMP --icmp-type 8 -j DROP
I have written this rules in response to these guidelines
• Only allow HTTPD traffic from WINPE1. Use an ACCEPT command. We are implementing a DROP policy.
• Allow Ping traffic from WINPE1 only. Again use an ACCEPT command.
However in the guidelines it is stated that Subnet addressing (like 192.160.10.0/24 for example) must be used throughout the firewall, no individual IP addresses allowed for source machines and no specified ranges allowed either e.g. --src-range 192.168.1.100-192.168.1.200.
How do I change the 192.168.10.5 address to cidr notation without granting access to other ip addresses?
firewall
edited Nov 21 at 21:44
Community♦
1
asked Nov 21 at 20:19
abignetworknoob
1
New contributor
abignetworknoob is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
WINPE1 = 192.168.10.5
iptables -A INPUT -p tcp -s 192.168.10.5 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -s 192.168.10.5 -p ICMP --icmp-type 8 -j ACCEPT
iptables -A INPUT -p ICMP --icmp-type 8 -j DROP
I have written this rules in response to these guidelines
• Only allow HTTPD traffic from WINPE1. Use an ACCEPT command. We are implementing a DROP policy.
• Allow Ping traffic from WINPE1 only. Again use an ACCEPT command.
However in the guidelines it is stated that Subnet addressing (like 192.160.10.0/24 for example) must be used throughout the firewall, no individual IP addresses allowed for source machines and no specified ranges allowed either e.g. --src-range 192.168.1.100-192.168.1.200.
How do I change the 192.168.10.5 address to cidr notation without granting access to other ip addresses?
firewall
firewall
edited Nov 21 at 21:44
Community♦
1
asked Nov 21 at 20:19
abignetworknoob
1
New contributor
abignetworknoob is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited Nov 21 at 21:44
Community♦
1
asked Nov 21 at 20:19
abignetworknoob
1
New contributor
abignetworknoob is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited Nov 21 at 21:44
Community♦
1
edited Nov 21 at 21:44
Community♦
1
edited Nov 21 at 21:44
Community♦
1
1
asked Nov 21 at 20:19
abignetworknoob
1
New contributor
abignetworknoob is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked Nov 21 at 20:19
abignetworknoob
1
asked Nov 21 at 20:19
abignetworknoob
1
1
New contributor
abignetworknoob is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
abignetworknoob is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
abignetworknoob is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
3
I've never seen192.160.10.024used, why the backslash instead of a forward slash?
– thrig
Nov 21 at 20:31
add a comment |
3
I've never seen192.160.10.024used, why the backslash instead of a forward slash?
– thrig
Nov 21 at 20:31
3
3
I've never seen
192.160.10.024 used, why the backslash instead of a forward slash?– thrig
Nov 21 at 20:31
I've never seen
192.160.10.024 used, why the backslash instead of a forward slash?– thrig
Nov 21 at 20:31
add a comment |
1 Answer
1
active
oldest
votes
up vote
2
down vote
iptables is able to handle networks realy easy.
In your case:
iptables -A INPUT -p tcp -s 192.168.10.0/24 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -s 192.168.10.0/24 -p ICMP --icmp-type 8 -j ACCEPT
iptables -A INPUT -p ICMP --icmp-type 8 -j DROP
Or instead of 192.168.10.0/24 you can use 192.168.10.0/255.255.255.0
answered Nov 21 at 21:33
Alexander
993113
add a comment |
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
2
down vote
iptables is able to handle networks realy easy.
In your case:
iptables -A INPUT -p tcp -s 192.168.10.0/24 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -s 192.168.10.0/24 -p ICMP --icmp-type 8 -j ACCEPT
iptables -A INPUT -p ICMP --icmp-type 8 -j DROP
Or instead of 192.168.10.0/24 you can use 192.168.10.0/255.255.255.0
answered Nov 21 at 21:33
Alexander
993113
add a comment |
up vote
2
down vote
iptables is able to handle networks realy easy.
In your case:
iptables -A INPUT -p tcp -s 192.168.10.0/24 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -s 192.168.10.0/24 -p ICMP --icmp-type 8 -j ACCEPT
iptables -A INPUT -p ICMP --icmp-type 8 -j DROP
Or instead of 192.168.10.0/24 you can use 192.168.10.0/255.255.255.0
answered Nov 21 at 21:33
Alexander
993113
add a comment |
up vote
2
down vote
up vote
2
down vote
iptables is able to handle networks realy easy.
In your case:
iptables -A INPUT -p tcp -s 192.168.10.0/24 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -s 192.168.10.0/24 -p ICMP --icmp-type 8 -j ACCEPT
iptables -A INPUT -p ICMP --icmp-type 8 -j DROP
Or instead of 192.168.10.0/24 you can use 192.168.10.0/255.255.255.0
answered Nov 21 at 21:33
Alexander
993113
iptables is able to handle networks realy easy.
In your case:
iptables -A INPUT -p tcp -s 192.168.10.0/24 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -s 192.168.10.0/24 -p ICMP --icmp-type 8 -j ACCEPT
iptables -A INPUT -p ICMP --icmp-type 8 -j DROP
Or instead of 192.168.10.0/24 you can use 192.168.10.0/255.255.255.0
answered Nov 21 at 21:33
Alexander
993113
answered Nov 21 at 21:33
Alexander
993113
answered Nov 21 at 21:33
Alexander
993113
answered Nov 21 at 21:33
Alexander
993113
993113
add a comment |
add a comment |
abignetworknoob is a new contributor. Be nice, and check out our Code of Conduct.
abignetworknoob is a new contributor. Be nice, and check out our Code of Conduct.
abignetworknoob is a new contributor. Be nice, and check out our Code of Conduct.
abignetworknoob is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f483294%2fiptables-configuration-cidr-notation%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
3
I've never seen
192.160.10.024used, why the backslash instead of a forward slash?– thrig
Nov 21 at 20:31