[SOLVED] Block Web Access With Iptables

mossy464 · 04-25-2010, 12:21 PM

Hi,

Just wondering if it is possible to block web access on a certain ip address with iptables.

Iv seen guides for blocking web traffic on a whole network but i want to just block a single host from accessing the web.

Thanks

smoker · 04-25-2010, 12:55 PM

Code:

iptables -A OUTPUT  -j DROP -p tcp --dport 80 -s 192.168.1.65 -o eth0

obviously change the ip address.
You may want to add a similar rule for port 443 which is the https port.
Also make sure the ethX is correct for your system.

mossy464 · 04-25-2010, 01:00 PM

Thank you very much for this.

mossy464 · 04-26-2010, 12:45 PM

I tried running this but it didnt work.

I have an ubuntu 9.10 vm set up as a router.

The host os is xp. I tried blocking web access on the host os but no joy.

Here is my setup.

adsl router: 192.168.1.254

ubuntu:

eth0: 192.168.1.1

eth1: 192.168.0.1

xp: 192.168.0.2 - gateway 192.168.0.1

any ideas why this wont work. The command works if i just try to block web access on ubuntu but not on the xp host.

smoker · 04-26-2010, 01:13 PM

Which ip address did you use in the command ?

mossy464 · 04-26-2010, 01:15 PM

In the command i used 192.168.0.2.

I tried -o eth0 and eth1

smoker · 04-26-2010, 01:49 PM

Use the xp gateway address in the -s . Whichever ethX connects to your router use as the -o ethX

mossy464 · 04-26-2010, 01:52 PM

Wont this just block web access on everything?

Should have said this but i also connect an xp laptop to my network.

its ip is 192.168.0.3 gateway 192.168.0.1

smoker · 04-26-2010, 01:58 PM

can you successfully block the laptop ?

mossy464 · 04-26-2010, 02:03 PM

Nope. Tried the laptop but the same, no joy

smoker · 04-26-2010, 02:10 PM

If you block the gateway address 192.168.0.1 does it block both the xp machines ?

mossy464 · 04-26-2010, 02:16 PM

No, this is strange. Here is the command i entered:

Code:

sudo iptables -A OUTPUT -j DROP -p tcp --dport 80 -s 192.168.0.1 -o eth0

smoker · 04-26-2010, 02:30 PM

I don't think the xp machines are using the gateway that you think they are.
If you block the ubuntu address, do the xp machines lose connection too ?

mossy464 · 04-26-2010, 02:35 PM

Nope when i block the ubuntu machine from accessing the web i can still access the web on the windows machines.

I have checked ipconfig on both windows machines to make sure the gateway is 192.168.0.1 and it is.

One thing though. I have the DNS server set to 192.168.1.254 as this is the only way i could get the internet to work on the xp machines.

Would this affect the iptables rule?

smoker · 04-26-2010, 02:56 PM

On the ubuntu machine run this

Code:

iftop -nP -f "port 80"

and access the web using an xp machine.
See which ip is doing the accessing.