Some technical help, please?

[mapsedge]

Regarding Subnet Masks:

We're getting some SQL injection attacks through our websites from someone in China, specifically (today) 219.135.103.53.  Our system is written to be resistant to that sort of thing but because I'm a vindictive bastard, and because I'm tired of my Inbox being full of notifications of "un-runnable queries", I use IIS to block access by IP.


What I'd like to do now is use a subnet mask and just block everything from 219.135.0.0  up to 219.135.255.255. 

Am I correct to set the IP to 219.135.0.0 and the subnet mask to 0.0.255.255...?

EDIT: SORRY.  Subnet mask is 255.255.0.0

I've tried to make sense of the documentation - and kinda do within the amount of time I have to do so - and used an online calculator to arrive here.  I just want to confirm it because I'm the only guy on this friggin' boat with a hand in the engine.

Comments

[sacristan.livejournal.com]

Depends on if you're using a Cisco or not. The above is fine for a Cisco ACL.

[sacristan.livejournal.com]

For IIS, change the subnet mask to 255.255.0.0.

Wha??

[cobracao.livejournal.com]

This doesnt look right. I don't think that will work the way you are expecting. It is also highly possible that you would end up blocking a lot more than you would expect.
The Subnet masks should be used merely to limit the scope of your network.

It seems to me you should be able to more simply block the range of IP Addresses that are giving you problems. That would be the safest bet...

Re: Wha??

[billthetailor.livejournal.com]

Sorry. Had my zero's and 255's mixed up. Got it worked out.

Re: Wha??

[thebruce.livejournal.com]

I should give you my list. Blocks everything from China and Korea, and most of India and a lot of Eastern Europe.

You'll find that access lists (IP Security) on IIS eats processor, which is fine if you've got it to spare, but the right way to do that is with either a firewall or with an acl on a router. Or a combination of both, if you happen to have a Cisco router with a firewalling IOS.

Wikipedia used to have a rather educational article on subnetting and subnet masks.

Re: Wha??

[billthetailor.livejournal.com]

Unfortunately we don't have control of our router, although our ISP might be willing to set up the entries for us. I'll email them and see; in the meantime, yes, please, I would love to have the list.