IP tables fails to block a domain or DNS

Question

I recieved a tcpdump on my linux which is from domain for ex: sdnpoks.shizuoka.ocn.ne.eu to port 2895 UDP as length 0

On resolving this domain i get ip address as 12.12.136.158.

I inserted it into iptables to drop this domain requests as follows.

I have a iptables rule as

DROP       all  --  12.12.136.158       0.0.0.0/0 

Despite adding this rule, iptables is failing to drop requests from this domain

EDITED: to include all rules

1        0     0 ACCEPT     all  --  *      *       45.117.26.115        0.0.0.0/0           
2     199K   32M ACCEPT     all  --  *      *       106.193.0.0/16       0.0.0.0/0           
3        0     0 DROP       all  --  *      *       202.231.72.67        0.0.0.0/0           
4        0     0 DROP       all  --  *      *       12.12.136.158        0.0.0.0/0           
5        0     0 DROP       all  --  *      *       8.4.0.0/24           0.0.0.0/0           
6        0     0 DROP       all  --  *      *       180.33.0.0/24        0.0.0.0/0           
7        0     0 DROP       all  --  *      *       202.231.0.0/16       0.0.0.0/0    

Answer 1

That rule is likely correct; the placement is probably not.

The thing to remember is that firewall rules are checked in the order they are listed. The kernel will stop processing the chain when a rule is triggered that will either allow or dis-allow a packet or connection.

Please use [sudo] iptables-save or [sudo] iptables -L -v -n --line-numbers to dump your full config.

I think the most common mistake for novice firewall administrators is that they follow the correct instructions to add an extra rule and then discover that it won't take effect.

The reason for that is that the -A option appends that new rule, after all existing rules and the final decision to (dis-)allow the traffic is made long before that new rule gets triggered.