ip route command with a range, not a CIDR

Question

I have a list of IPs such as these country ones from i-blocklist: https://www.iblocklist.com/lists.php?category=country

They only provide ranges without a subscription, such as: 201.237.0.0-201.237.255.255

I need to route a few of those lists out a specific interface on a server but I don't see an option in ip route to specify a range in the above notation.

Any ideas?

Answer 1

The netmask tool can be very handy to convert a range to a CIDR:

$ netmask 201.237.0.0:201.237.255.255
201.237.0.0/16
$ netmask 201.238.3.0:201.238.9.255
201.238.3.0/24
201.238.4.0/22
201.238.8.0/23

You should also see if using ipset or the iptables geoip module, part of xtables-addons wouldn't be more useful than using directly those ranges.

For geoip, look at this usage example in this Q/A: Ubuntu IPTables allow only allow 1 country

Answer 2

Expanding on A.B Answer - you can convert an entire list to CIDR notation using

for each in `cut -f2 -d":" ad  | tr "-" ":"` ; do netmask $each 2>/dev/null; done

Or to IP/Netmask notation with

 for each in `cut -f2 -d":" ad  | tr "-" ":"` ; do netmask -s $each 2>/dev/null; done

So to push all the IP's from a particular range through a particular interface you could do somethhing like

Putting it together you could create a command with a script as below - removing the "echo" and finishing the iptables command as appropriate for your requirements:

#! /bin/bash

TMPFILE="/dev/shm/$$.del"

for each in `cut -f2 -d":" ad  | tr "-" ":"`
do
        netmask -s $each 2>/dev/null;
done > $TMPFILE


while read -r each
do
        ROUTE=${each%/*}
        NETMASK=${each#*/}
        echo /sbin/route add $ROUTE netmask $NETMASK ....
done <$TMPFILE

Answer 3

No such thing as range routing. You can route subnets (as close to the desired range as you need) and supplement that with how many other independent not included in the subnets IPs you need.

In your example, 201.237.0.0-201.237.255.255 is a not a range, it's the subnet 201.237.0.0 /16 . You can route it in one-shot.

A range would be something as 201.237.0.1-201.237.1.3, which would be impossible to route under this format. In this scenario, you would need to route 201.237.0.0 /24 and separately 201.237.1.0 /30, so you basically cover it with 2 routes, but that's an easy one. Things can get much more complicated.