Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to temporarily block all traffic from a single ip address to my host (Ubuntu 10.10, 2.6.35). Normally I'd use iptables but that package is not installed, and while I have root on this box, installing packages is out of the question.

share|improve this question
2  
Are you sure that iptables isn't installed? Maybe it's just not in your path. –  sciurus Dec 19 '11 at 14:46
    
dpkg -l says it's not installed and find / -name "iptables" comes up empty. –  mpm Dec 19 '11 at 15:25
add comment

2 Answers

up vote 8 down vote accepted

If it would suffice to block the return packets from your host back to the IP in question, you could null route their /32:

# ip route add prohibit w.x.y.z/32 

Inbound traffic will still arrive, but the three-way handshake on TCP connections will not complete, so any new inbound connection (and indeed existing connections) will be rendered useless.

share|improve this answer
    
That'll do. Thanks, Alnitak. –  mpm Dec 19 '11 at 15:26
add comment

What services do you want block? If it's just http you can do that in a .htaccess file, too. Another option is an entry in /etc/hosts.deny, see the manpage for that file.

share|improve this answer
    
The service is a custom one running over TCP. Will adding an entry to hosts.deny kill existing connections? –  mpm Dec 19 '11 at 14:49
    
no it won't kill existing connections. Nor AFAIK will it work unless the custom service is linked with the TCP wrappers libraries. –  Alnitak Dec 19 '11 at 14:51
    
I think that existing connections are not touched (I cannot promise tho). You need to edit inetd.conf to use the tcpd wrapper for that service. –  ott-- Dec 19 '11 at 14:54
    
@ott if it's running out of inetd - many services don't, or can't. –  Alnitak Dec 19 '11 at 14:57
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.