as far as i know, most of the time ISPs change the IP address-URL association in their DNS servers, so the URL is redirected to a page which displays the user a "this site is blocked" page. if an ISP really wants to stop the access to many hosts (tens of thousands), is it feasible for the ISP to start blocking their IP adresses? as i reckon, the ISP must filter out every packet by reading the header—which would be a very costly operation.
migrated from stackoverflow.com May 27 '11 at 19:08
This question came from our site for professional and enthusiast programmers.
It's trivial to filter by destination IP address. Routers already switch on header destination IP; you just have to set up a null route for the IP in question. Indeed, this is done on a regular basis for DDoS mitigation.
It is somewhat unclear if you're referring to an ISP blocking access to a given server "from the world" or blocking access "to parts of the world" from their own customers.
The two may look similar, but they're quite different and good designs for one does not translate as good designs for the other.
For the "make sure the world cannot see a given server", it would, as always, depend on the exact architecture of the web-hosting. These days, most providers will host sites not needing HTTPS on a shared server, using HTTP header information to differentiate different sites (virtual server hosting).
The "easy" way of blocking this is to simply change the server setup on the web server to point the request at a static site, saying "blocked" or similar, In conjuction with that, I'd probably also post a DNS change, redirecting the query to a server dedicated at saying just that.