Skip to contentSkip to conversation

Trying to setup two ethernet cards with two websites

DISCUSSION JUSTIN GERRY 4 participants 4 messages Jan 2, 2003 – Jan 3, 2003

lore
Share & tools
lore

JUSTIN GERRY

author
#0 lore raw

To streamline the firewall I am writing, can I be safe to assume that:

CLASS_A="10.0.0.0/8"
IF1="eth0"
IF2="eth1"

(For example, I will drop anything claiming to be from a Class A Private Network on either interface)
iptables -A INPUT -i $IF1 -s $CLASS_A -j DROP iptables -A INPUT -i $IF2 -s $CLASS_A -j DROP

can be written in one line as:
iptables -A INPUT -s $CLASS_A -j DROP

This way by not specifying the interface (as it can come from either eth0 or eth1) it will stop completely drop any requests claiming to be from a class A private network?

Many thanks,
Justin

#1 lore raw
Quoted 7 lines · JUSTIN GERRY

(For example, I will drop anything claiming to be from a Class A Private Network on either interface)
iptables -A INPUT -i $IF1 -s $CLASS_A -j DROP iptables -A INPUT -i $IF2 -s $CLASS_A -j DROP

can be written in one line as:
iptables -A INPUT -s $CLASS_A -j DROP

Yes, any field like -i or -s or -d when NOT specified defaults to
'any'.

-Ath

Signature · 4 lines
- Athanasius = Athanasius(at)miggy.org / http://www.miggy.org/
                  Finger athan(at)fysh.org for PGP key
	   "And it's me who is my enemy. Me who beats me up.
Me who makes the monsters. Me who strips my confidence." Paula Cole - ME
#2 lore raw
In reply to JUSTIN GERRY
Quoted 7 lines

To streamline the firewall I am writing, can I be safe to assume that:

CLASS_A="10.0.0.0/8"
IF1="eth0"
IF2="eth1"

Quoted 7 lines

(For example, I will drop anything claiming to be from a Class A Private Network on either interface)
iptables -A INPUT -i $IF1 -s $CLASS_A -j DROP iptables -A INPUT -i $IF2 -s $CLASS_A -j DROP

can be written in one line as:
iptables -A INPUT -s $CLASS_A -j DROP

Yes.
You'd only specify the incoming interface if you were to expect $CLASS_A on one interface, but not on the other interface. If you don't specify -i, iptables won't match the incoming interface, so it would only look at the source address.

Rob

#3 lore raw
In reply to JUSTIN GERRY
Quoted 11 lines

To streamline the firewall I am writing, can I be safe to assume that:

CLASS_A="10.0.0.0/8"
IF1="eth0"
IF2="eth1"

(For example, I will drop anything claiming to be from a Class A Private Network on either interface)
iptables -A INPUT -i $IF1 -s $CLASS_A -j DROP iptables -A INPUT -i $IF2 -s $CLASS_A -j DROP

Quoted 6 lines

can be written in one line as:
iptables -A INPUT -s $CLASS_A -j DROP

This way by not specifying the interface (as it can come from either eth0 or eth1) it will stop completely drop any requests claiming to be from a class A private network?

sure. then just add 192.168/16 and 172.16/12 ;-)