Block a spcific subset range in UFW

Zak

12/15/23, 4:35 PM

I am looking to block a specific range in a single line .. Is that possible with UFW?

I'd like to block 1.1.0.0 - 1.1.31.255, but the only way I've found to do so is to put 32 individual rules in IE

$ ufw insert 1 deny from 1.1.0.0/24 to any
$ ufw insert 1 deny from 1.1.1.0/24 to any
$ ufw insert 1 deny from 1.1.2.0/24 to any
$ ufw insert 1 deny from 1.1.3.0/24 to any
.....
....
...
..
.

Is there a way to block .0.0/24 -- .31.0/24 in a single line?

1 + 5

firewall

ufw

steeldriver

12/15/23, 6:19 PM

Wouldn't that just be `1.1.0.0/19` in CIDR notation?

Zak

12/15/23, 8:59 PM

Ummmm Yes .. Yes it would .. As you can tell I am a software developer, not a network guy. Thanks @steeldriver (Now reading about subnets and how to calculate them using CIDR)

steeldriver

12/15/23, 9:18 PM

I always have to look them up ;) Let us know if it works - or, better, write an answer

Zak

12/15/23, 10:10 PM

@steeldriver it did, in fact, work -- I have been using ARIN for years in my security mitigation, but never REALLY looked at the `CIDR` there and just used the tool for reporting abuse etc .. Your comment prompted me to read about the notation, and found that ARIN not only provides the block for you (assigned by corporation, or entity) but that MXToolBox (a tool I usually use for email IP validation) has a tool for validating CIDR blocks -- Productive day!

steeldriver

12/15/23, 10:14 PM

... I guess the way to look at this particular one is that since 32 is 2^5, you want to move 5 bits from the network portion to the host portion so 24 - 5 = 19

Score:2

Ubuntu

Zak

12/15/23, 10:03 PM

As @steeldriver stated in the comment above 1.0.0.0/19 is the ticket here.

If you have an Offending IP that is ruining your day, and are sure that you want to disallow the entire block -- an easy way to get the CIDR is to go HERE and enter the offending IP. It will readily give you the CIDR to plunk into ufw.

I used This Tool to play around and verify what @steeldriver suggested as well. It shows you the entire IP block that will be affected by the CIDR notation.

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Block a spcific subset range in UFW

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.