Home / ubuntu / Questions / 543037
Accepted
Miphix
Asked: 2014-10-29 22:09:23 +0800 CST

iptables and expressing your IP address to the rules dynamically

  • 772

I've been recently spending my time refining my iptable rules to be a little more robust than Ark linuxs Simple stateful firewall to include defense against some other known and nefarious attacks. One of these attacks includes a denial of service that tricks the victim to persistently reply to itself until it is no longer network-able.

$ iptables -A INPUT -d 47.156.66.17/32 -j DROP

The above rule assumes I'm using 47.156.66.17/32 as my IP and CIDR. Naturally, I'm not always at home with my laptop and don't always get the same IP and CIDR. My question to you my fellow ubuntu fans. Is this, how do I make the IP dynamic and responsive enough where it annalyzes the IP address per network without having to instate the rules for every connection? Plug and forget is the idea.

Would I have to put a second set of rules that initiate every time the network goes up and down or can it be as simple as tossing it into iptables-persistent, go have a lovely sandwhich at the local cafe and happily surf my heart out?

networking

1 Answers

  1. Best Answer

    If you are forced to use dynamic ip.

    You can use MAC based filtering in iptables, like this:

    iptables -A INPUT -m mac --mac-source 5E:D9:83:B6:61:8A -j DROP
    • 1