Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So this should be a simple issue, but for whatever reason I can't figure it out.

Here are my current rules:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
block      all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
block      all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
block      all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain block (3 references)
target     prot opt source               destination
DROP       all  --  hit-nxdomain.opendns.com  anywhere

I'm trying to block the "hit-nxdomain.opendns.com" location (dummy location). When I put in a real IP address can I can use from another location. If I try to hit my server from that location it still connects just fine. How can I get it to drop all requests from that IP address?

I'm using a chain because I will be dynamically modifying the blocked ip address(es) using a script, so I need to be able to clear out just the block chain without breaking the INPUT chain and add in new addresses. Can you show me what I'm doing wrong with it the way it currently is? As I said, the "hit-nxdomain.opendns.com" is just a dummy name. But if I have a valid IP there it's not blocking it.

share|improve this question
    
@Psiclopz - just FYI, your additional post was deleted because it was a non-answer posted in the "answers" section. In the future, just edit the post and add additional information there. –  EEAA Mar 21 '11 at 3:35
add comment

migrated from stackoverflow.com Mar 21 '11 at 0:21

This question came from our site for professional and enthusiast programmers.

2 Answers

Get the IP of that hostname:

$ host hit-nxdomain.opendns.com
hit-nxdomain.opendns.com has address 67.215.65.132

Block it:

$ iptables -I INPUT -s 67.215.65.132 -j DROP
share|improve this answer
    
Or put another way, ipchains will happily let you set a rule using a hostname, but doesn't work without using an IP address/subnet. –  sysadmin1138 Mar 21 '11 at 2:48
    
Yes, thanks for the clarification. –  EEAA Mar 21 '11 at 3:33
add comment

I don't see a problem with the rules. To block an IP address, you use

   # iptables -A INPUT -s 127.0.0.100 -j DROP

If you are still able to connect from that IP address, then check with tcpdump, if you are actually connecting with that IP, or if for some reason (Proxy, VPN, ...) you are visible on the host with the iptables rules as another IP address.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.