How to block IP range

[Gary Palmer]

On Mon, Oct 27, 2014 at 05:30:57PM +0100, Cristiano Deana wrote:
> On Mon, Oct 27, 2014 at 5:24 PM, Gary Palmer <gpalmer at freebsd.org> wrote:
> 
> Hi
> 
> >> For example, I need to block only 100 IPs in the range: 10.0.0.1-10.0.0.100
> 
> > tables?
> >
> > you can do things like
> >
> > table <blocked_hosts> persist file "/etc/pf/blocked_hosts.table"
> > block in quick log on $ext_if_ipv4 from <blocked_hosts> to any
> 
> I'm adding the fast way to build the file:
> 
> sh -c 'for ip in `jot 100 1 100`; do echo 10.0.0.$ip >>
> /etc/pf/blocked_hosts.table; done'

You can also make it a bit more efficient and use a few CIDR networks.  To
cover 10.0.0.1-10.0.0.100 you would need.

          10.0.0.1/32
          10.0.0.2/31
          10.0.0.4/30
          10.0.0.8/29
         10.0.0.16/28
         10.0.0.32/27
         10.0.0.64/27
         10.0.0.96/30
        10.0.0.100/32

I used an ancient perl tool called 'aggis' to get the above.  There are
probably more modern tools around.

Regards,

Gary