ip range with ipables | specify source ip range in iptables | specify destination ip range in iptables

iptables can use a range of IP address.
I have tested with iptables version 1.3.7 with Linux Kernel version 2.6.21-7.
Range specification depends on "iprange" module of iptables.


To specify a range of source IP address with iptables, use the following syntax,
# iptables -A INPUT -p tcp -m iprange --src-range 192.168.2.2-192.168.2.50 -j ACCEPT

To specify a range of destinationIP address with iptables, use the following syntax,
# iptables -A INPUT -p tcp -m iprange --dst-range 192.168.2.51-192.168.2.100 -j DROP

Configure Linux/Fedora as a Router | Enable Packet Forwarding in Linux/Fedora

Configuring a Linux Box as a Router is a easy task.

Step1: Set net.ipv4.ip_forward = 1 in the file /etc/sysctl.conf

Step2: Restart Network Service, command: service network restart
Note: If you do not want to Restart Network Service, use the following command to enable
packet forwarding: echo "1" > /proc/sys/net/ipv4/ip_forward

Step3: Add the static routes to different subnets, hosts etc. using the command: route add .....

Note: This will work if, the firewall don't block the packets from one sub-net to another.

Enable NAT on Linux|Configure NAT on Linux

NAT enabling is suitable when a Linux Box works as a router.

Assuming that, the Linux box has two network interface with the following parameters.

eth0: IP Address 192.168.10.1/24, connected with Local LAN.
eth1: IP Address 203.200.160.226/29, connected with WAN, Gateway: 203.200.160.225/29

To enable NAT for the Local Private LAN, iptables can be used.
Command is: iptables -A POSTRUTING -t nat -s 192.168.10.0/24 -o eth1 -j MASQUERADE
Note: This will work if,
1) the Linux Box is already configured to work as router.
2) the firewall don't block the packets from Private LAN to WAN.

Packet filtering using MAC address in Linux iptables

A host can be blocked by its MAC address.
Linux "iptables" with mac modules loaded.
A simple configuration is given below ----
iptables -A INPUT -m mac --mac-source 00:17:31:D0:76:9C -j DROP
This will block any request fro the MAC address 00:17:31:D0:76:9C.