Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to temporarily block all traffic from a single ip address to my host (Ubuntu 10.10, 2.6.35). Normally I'd use iptables but that package is not installed, and while I have root on this box, installing packages is out of the question.

share|improve this question
Are you sure that iptables isn't installed? Maybe it's just not in your path. – sciurus Dec 19 '11 at 14:46
dpkg -l says it's not installed and find / -name "iptables" comes up empty. – mpm Dec 19 '11 at 15:25
up vote 8 down vote accepted

If it would suffice to block the return packets from your host back to the IP in question, you could null route their /32:

# ip route add prohibit w.x.y.z/32 

Inbound traffic will still arrive, but the three-way handshake on TCP connections will not complete, so any new inbound connection (and indeed existing connections) will be rendered useless.

share|improve this answer
That'll do. Thanks, Alnitak. – mpm Dec 19 '11 at 15:26

What services do you want block? If it's just http you can do that in a .htaccess file, too. Another option is an entry in /etc/hosts.deny, see the manpage for that file.

share|improve this answer
The service is a custom one running over TCP. Will adding an entry to hosts.deny kill existing connections? – mpm Dec 19 '11 at 14:49
no it won't kill existing connections. Nor AFAIK will it work unless the custom service is linked with the TCP wrappers libraries. – Alnitak Dec 19 '11 at 14:51
I think that existing connections are not touched (I cannot promise tho). You need to edit inetd.conf to use the tcpd wrapper for that service. – ott-- Dec 19 '11 at 14:54
@ott if it's running out of inetd - many services don't, or can't. – Alnitak Dec 19 '11 at 14:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.