Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Using a log monitoring tool I had noticed an IP had attempted 100-200 logins as root though failed (PAM's logs caught that), those IPs differ slightly but originate to one single domain which is a dedicated server host somewhere which I do not care if I block access, no loss.

(EDIT: Or maybe an IP range if DNS resolution is not done during checking.. I do not know how to do that either.)

I added the IPs to my iptables, how would I block a whole host ( from accessing any of the services on my VPS including SSH? I am using Ubuntu 10.04LTS Server.

share|improve this question
up vote 4 down vote accepted

iptables does not, nor should it, use the DNS, but you can block an address range with a single statement provided the range is a complete netblock, eg:

iptables -A INPUT -s -j DROP

will (provided you don't have a conflicting ACCEPT earlier in the the INPUT chain) drop all packets coming from sources

If you're not familiar with netblocks and the slash-notation for CIDR, a good guide can be found at .

share|improve this answer
Thank you, thankfully I know how the integer is formed, so CIDR ranges come naturally for me. I also implemented fail2ban! That should obviously stop the taunting 100 retry attempts. – John R. Dec 14 '10 at 10:25

If you only need to block ssh sessions this is a very useful script -

share|improve this answer

For blocking Source IP Addres............ ):

iptables -A INPUT -s -j DROP

The RedHat INIT script is very similar. You can use it to start and stop iptables, as well as save rule sets.

To save your active rules execute the following:

/etc/init.d/iptables save

This will save your rules to '/etc/sysconfig/iptables'.

When you start iptables, the rules are read from '/etc/sysconfig/iptables':

/etc/init.d/iptables start

Starting iptables [OK]

And when you stop iptables, all rules are flushed:

/etc/init.d/iptables stop

Stopping iptables [OK]

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.