9

I'd like to block an entire set of IPs on the server:

iptables -A INPUT -s 77.0.0.0/8 -j DROP

Though when I run

iptables -L

on that record I get a strange domain instead of the IP

DROP       tcp  --  x4d000000.dyn.telefonica.de/8  anywhere
  • 8
    Please, don't use images when you can use text. – Vinz Nov 8 '15 at 0:48
  • 4
    You're blocking an entire /8? 0.5% of the entire IPv4 address space? That's a lot of collateral damage, if you're running a public service. – Matt Nordhoff Nov 8 '15 at 8:17
  • @MattNordhoff, I've checked and it's confined within a specific country. Yes, I want that as it is not a public service! – João Pimentel Ferreira Nov 8 '15 at 9:31
  • @Vinz thanks for the tip, I already approved the edit change – João Pimentel Ferreira Nov 8 '15 at 9:33
  • 4
    You are wrong in regards of only blocking 1 country with that range. Doing some random lookups on Ripe I found blocks in use in DE, DK, SE, PL and RO. Just FYI :) – Frederik Nielsen Nov 8 '15 at 10:46
16

This is normal, nothing to worry about move on and you should read the documentation.

You didn't specify -n

-n, --numeric Numeric output. IP addresses and port numbers will be printed in numeric format. By default, the program will try to display them as host names, network names, or services (whenever applicable).

so iptables tries it's best to provide a meaningful name. If you do a reverse lookup on 77.0.0.0 the result will look familiar.

dig -x 77.0.0.0 +short
x4d000000.dyn.telefonica.de.
| improve this answer | |
0

I should simply have done:

iptables -L -n
| improve this answer | |
  • 2
    You can get even more information about the rules by using iptables-save. – kasperd Nov 7 '15 at 23:15
  • 7
    Self-answering a question is perfectly valid, but not if there is another answer which essentially says the same. – glglgl Nov 8 '15 at 8:28
  • 1
    @glglgl I was just trying to synthesize, for further reading. I set the other answer as the correct solution – João Pimentel Ferreira Nov 8 '15 at 9:29
  • @joao_pimentel Then it should be ok! – glglgl Nov 8 '15 at 21:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.