Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How would an example whitelist look like, that would whitelist a
range of all IPs from - ?

I have the whitelistfile in

share|improve this question
up vote 2 down vote accepted

I spent a good half an hour searching the web and found absolutely no documentation regarding your question, neither in English nor in Italian (mod_spamhause author Luca Ercoli is Italian). We're not entirely out of luck, though. The mod_spamhause code was published on-line and we can have a look at how filters are handled in this unit. The part of the code relevant to your question is (in C++):

if ( (strchr(lista[count],'/') == NULL )){
  if ( strcmp(lista[count],r->connection->remote_ip) == 0  ) return 1;
else {
  sscanf(lista[count], "%[^/]/%u", ippi, &bitmask);
  sscanf(ippi, "%lu.%lu.%lu.%lu", &a, &b, &c, &d);
  first = (a << 24) + (b << 16) + (c << 8) + d;
  mask = (0xFFFFFFFF << (32 - bitmask));
  last = first + (~mask);
  first = htonl(first);
  last = htonl(last);
  in.s_addr = first;
  sscanf(inet_ntoa(in), "%d.%d.%d.%d", &a_min, &b_min, &c_min, &d_min);
  in.s_addr = last;
  sscanf(inet_ntoa(in), "%d.%d.%d.%d", &a_max, &b_max, &c_max, &d_max);
  sscanf(r->connection->remote_ip, "%d.%d.%d.%d", &a_daverificare, &b_daverificare, &c_daverificare, &d_daverificare);
  if (
     ((d_daverificare <=  d_max) && (d_daverificare >=  d_min)) &&
     ((c_daverificare <=  c_max) && (c_daverificare >=  c_min)) &&
     ((b_daverificare <=  b_max) && (b_daverificare >=  b_min)) &&
     ((a_daverificare <=  a_max) && (a_daverificare >=  a_min))
  ) return 1;

It's quite straight-forward, but if you don't read C++ then let's just sum it up that it will accept both individual IPs as well as CIDR ranges, formatted same as Apache does.

To answer your question then, according to this code, you can add a CIDR range (that covers IPs - as a single line in your /etc/spamhaus.wl like so:

The published code would handle CIDR notation, however we have no way of knowing this code is actually in use with your mod_spamhaus build. If it doesn't work for you then I'd suggest you search for other builds, or compile your own version using published code.


share|improve this answer

After looking up the module, there is very little to no documentation on how it expects the whitelist to be. I would gather to guess that it will take CIDR based values or individual IPs.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.