Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 702
  • Last Modified:

Need to block wan ip address that ranges from 172.XXX.XXX.80 - 100.

How can I block not just the range of 80 - 100, but the full WAN IP? Can I put a block in the firewall for 172.XXX.XXX.0 and that will cover that whole IP range??
0
jmahlmann
Asked:
jmahlmann
4 Solutions
 
farzanjCommented:
Yes you can.  Which firewall are you using?  A network (Cisco PIX)? Or a Linux firewall??

Warning:  This can cause unexpected problems as it would stop all of your WAN network traffic even DNS lookups.

Allow the addresses you want --your internal address ranges and disallow the rest.

For iptables

iptables -A INPUT -s 172.0.0.0 -j ACCEPT
iptables -A INPUT -s 0/0 -j DROP

Open in new window

0
 
HaiFaiCommented:
Hi

Yes this should work 172.XXX.XXX.0/24 (that 24 is shortcut for mask 255.255.255.0)
or 172.XXX.XXX.0 if you cannot specify mask there.
0
 
schmitty007Commented:
Depending on what device you are using as a firewall the steps to apply this filter will be different but, you can block a range of IPs or different subnets with most firewalls by simply entering the IP range or subnet you wish to block.

Example: 172.0.0.0 /8 or 172.0.0.0 255.0.0.0 that will block all 172.x.x.x addresses but the principle applies. A good idea for you might be to download/look up a subneting app either to your phone or on the web and input the IPs you want to block and move the subnet until it best fits the range you want to block.

As poster above has stated this may cause undesirable effects in block web pages or services you don't intend to block.
Also note that 172.16.0.0 to 172.31.255.255 address range is reserved for private use and do not route over the internet. And that subnet is represented by 172.16.0.0/19 or 172.16.0.0 255.255.224.0.
0
Worried about phishing attacks?

90% of attacks start with a phish. It’s critical that IT admins and MSSPs have the right security in place to protect their end users from these phishing attacks. Check out our latest feature brief for tips and tricks to keep your employees off a hackers line!

 
gheistCommented:
172.x.x.x may be a RFC1918 address thus really you might need to ask your WAN provider to block martian traffic.
0
 
Fadi SODAH (aka madunix)Chief Information Security Officer, CISA, CISSP, CFR, ICATE, MCSE, CCNA, CCNP, CCIP, SCSC and SCECommented:
try to drop the network block on the interfaces of your network router
ip route x.y.z.0 255.255.255.0 Null0
0
 
gheistCommented:
Normally provider has to do it, but does not hurt if you find they do not. Say mine is leaking 10.x.x.x of their service network all the time...
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now