How Do I block an IP Range ?

[martop01]

Hi,

I am really getting lost with this, I have the 7800N and have a server hooked to it, this server has a web server running on port 80 and I have forward that port and the IP of the server so I can access it externally, it all works but I want to try to allow only a range of external IP addresses to access the web server.

I created a packet filter for the to and from external IP range and the port numbers and set it to incoming and forward
A rule was made to the drop any external IP range on port 80.

Testing this with an external IP address allowed me to access the server as I have a computer with an external IP address in my set range but if I set the packet rule to drop for testing if it blocks, it still lets me access the web server

Can some kind person put me out of my misery and point to a guide for doing this, the idea being only IP addresses in a selected range can access the web server

Thanks for any help offered

[billion_fan]

Hi martop01

Can you send me a screen capture of your settings, so I can advise on how you should setup the rule within the packet filtering section.

A screen capture of your packet filtering page should do.

Thanks

[martop01]

Hi billion_fan, thank you for replying,

I thought this would be easy as I understood a packet filter rule would allow me to select a range of ip addresses from outside my network to access the server, I seem to be able to do this woth psrt forwarding easy enough but controlling the ip range has got me stumped.

The first image is packet rule I am trying to make, the external ip range is the one I want to allow, I want everything outside that range to be blocked but I only have the options to forward or drop ?

The second image is the virtual server or port forward rule that I know works but that just allows any ip address to see the server
Thanks for helping, much appreciated

[sabre999uk]

Hi,
Take a look at my reply in this post viewtopic.php?f=9&t=106 it shows how I set up the packet filtering & port mapping to do the same thing with ftp.

Steve

[martop01]

Thank you

I will start over and follow the suggestion, the picture of the packet filter wasnt complete as I took it while making the rule. I'm not to familiar with the billion router as its new so it takes a bit of getting used to, I thought you could either port forward or packet filter as they did the same thing, things you learn

Thanks for helping, much appreciated

[martop01]

Hi,
Take a look at my reply in this post viewtopic.php?f=9&t=106 it shows how I set up the packet filtering & port mapping to do the same thing with ftp.

Steve

I started with a new set up and followed the settings you suggested, mine differs in that the incoming ip is a range so I set it for that and made sure it logged both the forward and drop rules, from what I can see, its working !

Thank you for providing the link to the setup page you created, much appreciated.
--
Martop

[martop01]

sabre999uk,

I just want to say thank you for your help and your guide, I had the rules set up and its working, lots of dropped packets in the logs and the only forward packets are from the desired ip range. I did test this with a anonymous proxy, as expected the proxy times out, the rest of the logs are from the people I want to keep out

Thanks,

Martop

[sabre999uk]

Hi,
Glad I could help.

Steve