Blocking ranges of addresses
Novell Cool Solutions: Question & Answer
Q:
We have an NBM 3.8 box for proxy, VPN, and firewall services. I've noticed that we get hit from several ranges of IP addresses. Is is possible to block all access from ranges of addresses, like: 213.*.*.* ? If so, do I use a filter or an access rule, and can wildcards be used?
A:
There's not a simple way to do this with packet filters or access rules. The problem is that in the standard configuration the filter exceptions (to allow)
overwrite the filters (to block), therefore adding a filter for a certain network won't work.
The easiest way to "block" is actually putting a bogus routing entry in the server routing table. For instance you could put a static routing entry like:
213.1.1.0/255.255.255.0 next hop 10.0.0.1
where 10.0.0.1 is an IP address in your internal network that isn't assigned to any machine.
Novell Cool Solutions (corporate web communities) are produced by WebWise Solutions. www.webwiseone.com