ipt_privateip

ipt_privateip netfilter extension, part of software.klolik.org

[about] [todo] [bugs] [downloads] [example] [faq]

About

ipt_privateip is netfilter extension that can be used to match (non) private address spaces of IPv4, but it's more than fixed ipset.
As private address space is considered any of 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.
The power of this extension is to match all of spaces at once, possibly using operator between source and destination IP.
Tested on Linux kernel 2.6.35.5.

[back to top]

TODO

See bugs.

[back to top]

Bugs

Description	Version	Status*	Temporary fix
compilation errors on older kernels or older iptables	0.1.0	pending	uncomment #define HAVE_XT_MATCH_PARAM on .c files

[back to top]

Downloads

Sources released under GNU License.
If you use this software, please send me an e-mail with comment. Thank you.

Latest version:
[2011.07.03] ipt_privateip-0.1.0.tar.gz

Older versions:

[back to top]

Example

Extension options:

# iptables -m privateip -h
[...]
privateip match options:
--private-ip [!]src
--private-ip [!]dst
--private-ip [!]srcOP[!]dst
	where OP is one of +,^= (and/or/xor/same)

Operator table:

operator	description	example	example explanation
+	AND	src+!dst	match from (any) private to non-private
,	OR	src,dst	match from (any) private or to (any) private
^	XOR	src^dst	match from (any) private to non-private or from non-private to (any) private (would be equal to: (src+!dst),(!src+dst) but this extension does not support complex syntax)
=	(the) SAME (pool)	src=dst	match from private pool to the same private pool (-s 192.168.0.0/16 -d 192.168.0.0/16 \|\| -s 10.0.0.0/8 -d 10.0.0.0/8 \|\| ... – this is not the same as src+dst)

To deny all packets to private IPs:

# iptables -A test -m privateip --private-ip dst -j DROP

To drop packets from private or to private:

# iptables -A test -m privateip --private-ip src,dst -j DROP

To count packets from 10.0.0.0/8 to 10.0.0.0/8 or from 172.16.0.0/12 to 172.16.0.0/12 or from 192.168.0.0/16 to 192.168.0.0/16:

# iptables -A test -m privateip --private-ip src=dst

[back to top]

FAQ

I did not use "&"/"|" symbols as AND/OR because of shell expansion, it would be annoying to need to escape them.