Open main menu

Для администраторов, разбирающихся в CIDREdit

Sysops on all wikis now have the ability to block ranges. Before you can block an IP range, you need to put "$wgSysopRangeBans = true;" in your LocalSettings.php file. After you have enabled range blocking, you will be able to enter a subnet specification in CIDR notation into the Special:Blockip address box. For example, 12.64.96.0/24 blocks all addresses between 12.64.96.0 and 12.64.96.255. Note that even registered users, using these IPs, will be blocked, too.

Note that 12.64.96.128/24 will not do what you expect. The /24 designation means that the first 24 bits specify the network. So 12.64.96.128/24 is the same as 12.64.96.0/24. The last 32-N bits are not significant, and are automatically set to zero in the software.

MediaWiki only support CIDR suffixes between 16 and 31, inclusive (as of 23 May 2005). Therefore, for example, 12.64.96.128/8 will be rejected.

Here is a chart of network prefix lengths, showing the number of addresses in each block, and giving an indication as to what part of the IP address changes between the start and end of the range. For example, /16 has a 1 in the 2nd byte column, which means if you block 142.177.0.0/16, the range is 142.177.0.0 to 142.177.255.255, that is it blocks for one value of the first two sections of the ip.

Не пользуйтесь блокировками диапазонов, если не уверены, что понимаете, что делаете!

Длина префикса Сколько адресов заблокируется 1й байт 2й байт 3й байт 4й байт
0 4294967296 256      
1 2147483648 128      
2 1073741824 64      
3 536870912 32      
4 268435456 16      
5 134217728 8      
6 67108864 4      
7 33554432 2      
8 16777216 1 256    
9 8388608   128    
10 4194304   64    
11 2097152   32    
12 1048576   16    
13 524288   8    
14 262144   4    
15 131072   2    
16 65536   1 256  
17 32768     128  
18 16384     64  
19 8192     32  
20 4096     16  
21 2048     8  
22 1024     4  
23 512     2  
24 256     1 256
25 128       128
26 64       64
27 32       32
28 16       16
29 8       8
30 4       4
31 2       2
32 1       1

Блокировка диапазонов для чайниковEdit

Эта секция предназначена для администраторов, не понявших ни черта в том, что написано выше.

Как это не делаетсяEdit

Никогда не блокируйте диапазоны, если не уверены на все 100 в том, что делаете. Цена ошибки велика — вы можете ненароком заблокировать гораздо больше народу, чем собирались.

Проще всего объяснить эту технику — привести пример. Допустим, вы хотите заблокировать следующие IP:

208.147.11.2 --> 208.147.11.16     (т. е. 15 адресов)

Если выдумаете, что для этого надо написать 208.147.11.2/16? Это была бы очень серьёзная ошибка! При этом заблокировалось бы

208.147.0.0 --> 208.147.255.255     (216 = ~65 тысяч адресов!)

Потому, что /16 указывает на количество бит, которые у блокируемых адресов общие. Теперь, когда вы знаете, чего не надо делать, перейдём к обратному.

How you should do itEdit

Technical preambleEdit

An IP address is usually written in dotted decimal notation to make it easy for humans to read but they are actually 32 bit binary numbers. For example

208.147.11.2 can be written as 11010000100100110000101100000010

(You can see why the dotted decimal notation is preferred by humans! But machines can only understand binary). The dotted decimal notation splits these 32 bits up into four blocks of 8. Then represents the 8 bit binary number as it's decimal value.

The /16 means only take the first 16 bits into account i.e. 1101000010010011 (208.147.foo.bar) the block will block any address that starts 208.147. no matter what the rest of the digits read.

Likewise a /24 will include the first 24 bits (the first three numbers of the dotted decimal). So 208.147.11.0/24 will block

208.147.11.0 --> 208.147.11.255 inclusive

How to actually work out the blockEdit

A /16 and a /24 are easy to see what will happen (because they are multiples of 8) They will block all addresses that have the first 2 (or 3) sections of the dotted decimal IP address in common. Likewise a /8 would block 2563 addresses (except that you are not allowed to do a /8 as it would cut out far too many people in one go). Sometimes however you may not want to block as many as 256 addresses. If we take our earlier example you may only want to block 208.147.11.2 --> 208.147.11.16 In this case you need to actually write out the binary expansion of the last number in the dotted decimal address. Let’s look at how you do that.

  • Write out the following
128  64  32  16  8  4  2  1

Underneath work out the digits of the decimal number

128   64   32   16   8   4   2   1
 0     0    0    0   0   0   1   0      (.2)
 0     0    0    1   0   0   0   0      (.16)

As you can see the first and last numbers differ only in the last 5 binary digits (the first three digits (128, 64, 32) are identical). So a suitable block would be 208.147.11.0/27. Note that this would still block some innocent numbers. For example the number 00011101 (.29) would be blocked. In fact this block will block a total of 32 numbers, which is a lot better than blocking 256. If you're really worried you could block 208.147.11.0/28 (which would block .0 to .15) and then block 208.147.11.16 separately.

Another exampleEdit

Just to make sure, let's do another one. Suppose you want to block

121.22.98.187 --> 121.22.98.194

Note the first three numbers of the address are the same so /24 would certainly block everything you want, but again it would block a whole lot more as well. So let's write out 187 and 194 as binary numbers

128   64   32   16   8   4   2   1
 1     0    1    1   1   0   1   1  (.187)
 1     1    0    0   0   0   1   0  (.194)

They have an identical first digit but differ after that so a 121.22.98.128/25 should do the trick (the 128 is because we set all of the last five digits=0) but note that this blocks 128 addresses when we only want to block 8.

Here splitting the range block into two or more smaller blocks may be a better strategy. For example if we use a /29 block we will lose the last 3 binary digits. Setting the last three digits of .187 to zero gives .184 and 121.22.98.184/29 will block .184 -> .191 that leaves 192 --> 194 which we could block individually or we could do 121.22.98.192/30 which blocks .192 -->.195. We still have a few innocents addresses caught up in the blocks( .184, .185, .186, .187, .195) but not nearly as many as with a /24 or a /25.

Can't be bothered to work all this stuff out manually? Don't worry, there are tools on the net that do all the hard work for you, such as this netmask calculator.

Sample block chartEdit

Remember, however, MediaWiki only support CIDR suffixes between 16 and 31

CIDR Beg Range End Range # of addresses Bits selected in IP address
69.208.0.0/0 0.0.0.0 255.255.255.255 4,294,967,296 ********.********.********.********
69.208.0.0/1 0.0.0.0 127.255.255.255 2,147,483,648, 0*******.********.********.********
69.208.0.0/4 65.0.0.0 79.255.255.255 268,435,456 0100****.********.********.********
69.208.0.0/8 69.0.0.0 69.255.255.255 67,108,864 01000101.********.********.********
69.208.0.0/11 69.208.0.0 69.238.255.255 2,197,152 01000101.110*****.********.********
69.208.0.0/12 69.208.0.0 69.223.255.255 1,048,576 01000101.1101****.********.********
69.208.0.0/13 69.208.0.0 69.215.255.255 524,288 01000101.11010***.********.********
69.208.0.0/14 69.208.0.0 69.211.255.255 262,144 01000101.110100**.********.********
69.208.0.0/15 69.208.0.0 69.209.255.255 131,072 01000101.1101000*.********.********
69.208.0.0/16 69.208.0.0 69.208.255.255 65,536 01000101.11010000.********.********
69.208.0.0/17 69.208.0.0 69.208.127.255 32,768 01000101.11010000.0*******.********
69.208.0.0/18 69.208.0.0 69.208.63.255 16,384 01000101.11010000.00******.********
69.208.0.0/19 69.208.0.0 69.208.31.255 8,192 01000101.11010000.000*****.********
69.208.0.0/20 69.208.0.0 69.208.15.255 4,096 01000101.11010000.0000****.********
69.208.0.0/21 69.208.0.0 69.208.7.255 2,048 01000101.11010000.00000***.********
69.208.0.0/22 69.208.0.0 69.208.3.255 1,024 01000101.11010000.000000**.********
69.208.0.0/23 69.208.0.0 69.208.1.255 512 01000101.11010000.0000000*.********
69.208.0.0/24 69.208.0.0 69.208.0.255 256 01000101.11010000.00000000.********
69.208.0.0/25 69.208.0.0 69.208.0.127 128 01000101.11010000.00000000.0*******
69.208.0.0/26 69.208.0.0 69.208.0.63 64 01000101.11010000.00000000.00******
69.208.0.0/27 69.208.0.0 69.208.0.31 32 01000101.11010000.00000000.000*****
69.208.0.0/28 69.208.0.0 69.208.0.15 16 01000101.11010000.00000000.0000****
69.208.0.0/29 69.208.0.0 69.208.0.7 8 01000101.11010000.00000000.00000***
69.208.0.0/30 69.208.0.0 69.208.0.3 4 01000101.11010000.00000000.000000**
69.208.0.0/31 69.208.0.0 69.208.0.1 2 01000101.11010000.00000000.0000000*
69.208.0.0/32 69.208.0.0 69.208.0.0 1 01000101.11010000.00000000.00000000

For example,

  • 69.208.0.0/16 would block 65,536 addresses ranging from 69.208.0.0 thru 69.208.255.255
  • 69.208.0.0/24 would block 256 addresses ranging from 69.208.0.0 thru 69.208.0.255

Final words of adviceEdit

If you've read the above and think you understand what to do, then do so cautiously. Post a note at the village pump/staff lounge (or whatever the general meeting place is on your wiki) explaining what you have done so that other users can check you haven't done something unpopular (Like blocking all AOL users).