Re: iptables and dhcp configuration

[Bill Shirley <bshirley@xxxxxxxxxxxxxxxxx>]

On 8/8/2012 5:56 AM, Jatin K wrote:
> Dear all,
>
>
> is there any way or method available to configure iptables to allow 
> only dhcp server assigned ip , means if user manually sets his/her 
> systems ip address then Linux gateway(FC16) should reject it .
> user must use the ip address which is assigned by dhcp, ( dhcp server 
> is running on the same machine where iptables are installed, and 
> machine is acting as a gateway )
>
> Warm Regards

Put this in your dhcpd.conf to record the IP address issue in an ipset:
        on commit {
                set ClientIP = binary-to-ascii(10, 8, ".", leased-address);
#               set ClientMac = binary-to-ascii(16, 8, ":", 
substring(hardware, 1, 6));
                set ClientLeaseTime = binary-to-ascii(10, 32, "", 
encode-int(lease-time, 32));
#               set ClientLeaseTime = encode-int(lease-time, 32);
#               set ClientLeaseTime = "14400";
                execute (
                        "/usr/sbin/ipset",
                        "-A", "DHCPuser",
                        concat (ClientIP, ",", ClientLeaseTime)
                );
        }

You'll probably have to change the execute command to work with the new 
syntax of ipset.

Then use the functionality of iptables to use the ipset to allow/deny 
access.  I use Shorewall for my firewall which makes it pretty easy.

Bill

--
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org