4

So this should be a simple issue, but for whatever reason I can't figure it out.

Here are my current rules:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
block      all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
block      all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
block      all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain block (3 references)
target     prot opt source               destination
DROP       all  --  hit-nxdomain.opendns.com  anywhere

I'm trying to block the "hit-nxdomain.opendns.com" location (dummy location). When I put in a real IP address can I can use from another location. If I try to hit my server from that location it still connects just fine. How can I get it to drop all requests from that IP address?

I'm using a chain because I will be dynamically modifying the blocked ip address(es) using a script, so I need to be able to clear out just the block chain without breaking the INPUT chain and add in new addresses. Can you show me what I'm doing wrong with it the way it currently is? As I said, the "hit-nxdomain.opendns.com" is just a dummy name. But if I have a valid IP there it's not blocking it.

Improve this question
1
  • @Psiclopz - just FYI, your additional post was deleted because it was a non-answer posted in the "answers" section. In the future, just edit the post and add additional information there.
    – EEAA
    Mar 21, 2011 at 3:35

2 Answers 2

Reset to default
7

Get the IP of that hostname:

$ host hit-nxdomain.opendns.com
hit-nxdomain.opendns.com has address 67.215.65.132

Block it:

$ iptables -I INPUT -s 67.215.65.132 -j DROP
Improve this answer
1
  • Or put another way, ipchains will happily let you set a rule using a hostname, but doesn't work without using an IP address/subnet.
    – sysadmin1138 ♦
    Mar 21, 2011 at 2:48
2

I don't see a problem with the rules. To block an IP address, you use

   # iptables -A INPUT -s 127.0.0.100 -j DROP

If you are still able to connect from that IP address, then check with tcpdump, if you are actually connecting with that IP, or if for some reason (Proxy, VPN, ...) you are visible on the host with the iptables rules as another IP address.

Improve this answer

You must log in to answer this question.