IPFilter 9000 question on IP ranges

[Bruce Baillie]

I have successfully installed IPFilter on HP-UX 11.00. I can block an IP address but how do I block a range?
The synyax I use for one is:
block in log on lan0 from 128.165.161.10 to any

I want a range of 128.165.161.10 to 128.165.161.20

[harry d brown jr]

You can use bit masks, but I don't think ranges are supported:

block in log on lan0 from 128.165.161.0/8 to any

live free or die
harry

[Steven Sim Kok Leong · Accepted solution]

Hi,

According to the features list at http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=B9901AA, IP ranges are supported:

Explicitly permits or denies a packet from passing through based on the following:
- IP address or a range of IP addresses
- IP protocol (IP/TCP/UDP)
- IP fragments
- IP options
- IP security classes
- TCP ports and port ranges
- UDP ports and port ranges
- ICMP message type and code
- Combination of TCP flags
- Interface

However, the way IPFilter defines and implements IP ranges is via subnet bitmasking as already mentioned by Harry.

In your case, it will not be efficient to use bitmasking for this purpose because you will need to specify pass in's for 20 times before the block in and then pass in any statement i.e.:

pass in log on lan0 from 128.165.161.1 to any
pass in log on lan0 from
128.165.161.2 to any
...
block in log on lan0 from 128.165.161.0/27 to any
pass in log on lan0 from any to any

Thus, it is instead easier for you to specify 11 times of block in's.

A scenerio whereby you can make use of bitmasking for this purpose is for example you wish to block from 128.165.161.8 to 128.165.161.31

In that case, you can do this:

pass in log on lan0 from
128.165.161.0/29 to any
block in log on lan0 from
128.165.161.0/27 to any
pass in log on lan0 from any to any

Hope this helps. Regards.

Steven Sim Kok Leong

[Bruce Baillie]

Thanks, that's the answer I was looking for.