I'm running a public Pi-hole on a Debian system. That works fine so far, but obviously one has to take care about malicious actors. Therefore I'm somewhat closely monitoring the client list and having a look for suspicious behaviour. If I find someone, I'll usually block the IP with iptables and people move on.
Quite often I have IPs from Digital Ocean hitting me hard, but not "too hard", so they could look like real user traffic without further investigation, only that they are doing lots of requests over the day in sum. After looking at their DNS requests, these are IPs that are monitoring/probing/searching various services with rather random URL patterns, possibly bruterforcing to find vulnerable systems. I'd like to discourage that use and have tried to ban those IPs. They come back with another IP of course, so I thought I'd try to ban the whole subnet.
That way normal users could still use the Pi-hole without any problems, but those VPS instances (or whatever) from Digital Ocean would be done for the moment. Obviously there are ways around that, too, but maybe they move on to someone else if I raise the hurdles. I'd be fine with that for the moment.
So I added the following rule to my iptables:
iptables -A INPUT -s 157.245.0.0/16 -j DROP
While iptables accepts that rule with no comment, I still see IPs from that subnet being served by the Pi-hole. That's at least what the Pi-hole logs/statistics tell me.
Is there something wrong with my iptables rule? Or are there better ways to create subnet-wide rules with iptables? I saw the range parameter but thought that defining the subnet scheme would be more intuitive and would like to use it therefore.
Thanks in advance!
edit: Here's the output of iptables-save: https://pastebin.com/Lm4zV1ii
-A
appends to the end of the table while-I
inserts the rule at the top of the table, and iptables goes off the first match from the top.iptables-save
to the question.