20 Jul
2019
20 Jul
'19
10:21 a.m.
Because of the current changes, people want to change firewall entries
that check an address to be "within AMPRnet".
This of course used to be simple, like "-s 44.0.0.0/8" as a matcher in
Linux iptables.
I already read remarks like "well I just need to split those rules in
two, one for 44.0.0.0/9 and another for 44.128.0.0/10".
This is not really required. And it is not so easy when the match was
in a "not" context, like: ! -s 44.0.0.0/8.
Also it makes the firewall rule list longer and maybe less intuitive.
Maybe not everyone knows how ipset can be used to match more than one
address in the same rule.
The ipset program creates "address sets" that can be lists of addresses,
networks, portnumbers etc that can then be referenced in a match.
For example, create an address set that contains the new AMPRnet ranges:
ipset create AMPRnet hash:net
ipset add AMPRnet 44.0.0.0/8
ipset add AMPRnet 44.128.0.0/10
ipset add AMPRnet 44.224.0.0/15
(the last one of course has to go, but I kept it there to give our
German friends some time to renumber)
Now instead of "-s 44.0.0.0/8" you can use: -m set --match-set AMPRnet src
Instead of "-d 44.0.0.0/8" it would be: -m set --match-set AMPRnet dst
And instead of "! -s 44.0.0.0/8" you still can use the form: -m set !
--match-set AMPRnet (src or dst), so
there is no need to change the structure of the rules to work around the
problem of not having a "not" operator.
Of course you need to arrange for the above commands to be run before
the iptables rules are loaded.
No problem for me as I have always done that in an own shellscript not
using distributor's solutions that use iptables-save or similar.
(I prefer to have the possibility to have comments, use variables
holding certain addresses and networks, etc)
In MikroTik RouterOS the same feature is available as "Address list" in
the firewall.
You can create an address list and load those subnet values:
/ip firewall address-list
add address=44.0.0.0/9 list=amprnet
add address=44.128.0.0/10 list=amprnet
and then use that in filter rules by using Src.Address List instead of
Src.Address for the match.
Rob