LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 05-09-2003, 07:11 AM   #1
digsby0007
Member
 
Registered: Jan 2003
Posts: 94

Rep: Reputation: 15
banning an IP


I saw an ip addres of someone that I do not reconize, and I want to ban that ip, but I dont see where to do that. I configured lokkit, and I have the stock firewall (btw i am using red hat 8.0) can anyone tell me how to ban ip's or recomend a good firewall for rh8?

Thanks,
Digsby
 
Old 05-09-2003, 08:44 AM   #2
markus1982
Senior Member
 
Registered: Aug 2002
Location: Stuttgart (Germany)
Distribution: Debian/GNU Linux
Posts: 1,467

Rep: Reputation: 46
Lokkit is based on netfilter (= iptables). netfilter is implemented in the linux kernel. There are no real firewalls besides netfilter since they all are just wrappers around netfilter.

To get more information, visit the homepage. You could then add a rule like that:

iptables -A INPUT -i eth0 -s xxx.xxx.xxx.xxx/32 -j DROP
 
Old 05-09-2003, 01:37 PM   #3
nakkaya
Guru
 
Registered: Jan 2003
Location: Turkey&USA
Distribution: Emacs and linux is its device driver(Slackware,redhat)
Posts: 1,398

Rep: Reputation: 45
but keep one thing in mind the person you ban if s/he diesnt have a static ip everytime s/he connects to internet ips will change and s/he connect to you again
 
Old 05-09-2003, 04:39 PM   #4
Crashed_Again
Senior Member
 
Registered: Dec 2002
Location: Atlantic City, NJ
Distribution: Ubuntu & Arch
Posts: 3,503

Rep: Reputation: 57
good point nakkaya...heres a question for one of you gurus:

Can you ban mac addresses?
 
Old 05-10-2003, 12:04 AM   #5
shahriars
LQ Newbie
 
Registered: Apr 2003
Posts: 22

Rep: Reputation: 15
Wink

yes, there is a solution provided by Trd79 at a thread I've started

you can check

http://www.linuxquestions.org/questi...threadid=50347

for the solution. It is quite primitive ( ;-) ) though, and needs a little bit of modification. But it works. Thanks to Trd79 for that.
 
Old 05-10-2003, 04:44 AM   #6
markus1982
Senior Member
 
Registered: Aug 2002
Location: Stuttgart (Germany)
Distribution: Debian/GNU Linux
Posts: 1,467

Rep: Reputation: 46
You CAN ban mac addresses but remember that this just works in a network WITHOUT routers since AFAIR the MAC get's rewritten once it passes a router. The mac address will then ban the router's MAC adr ...
 
Old 05-10-2003, 06:35 AM   #7
whansard
Senior Member
 
Registered: Dec 2002
Location: Mosquitoville
Distribution: RH 6.2, Gen2, Knoppix, 98,2000 + various
Posts: 3,171

Rep: Reputation: 51
you could drop their whole range of ip's. the dynamic
ip's will probably fit in a certain range. dropping everything
with the same first 3 numbers will probably do what you
want.
 
Old 05-11-2003, 04:11 PM   #8
bluenirve
Member
 
Registered: May 2003
Distribution: Slackware 10
Posts: 56

Rep: Reputation: 15
but then again, it will also probably effect someone else that's ok to connect to his computer... block ranges with caution
 
Old 05-11-2003, 05:57 PM   #9
whansard
Senior Member
 
Registered: Dec 2002
Location: Mosquitoville
Distribution: RH 6.2, Gen2, Knoppix, 98,2000 + various
Posts: 3,171

Rep: Reputation: 51
i'm just guessing that since he said it's
an address he didn't recognize, that he's only letting
a few specific people in anyway.
He would probably be fine to deny all and have a list he
permits. Assuming he's trying to deny all that he doesn't
know.
 
Old 05-11-2003, 06:05 PM   #10
bluenirve
Member
 
Registered: May 2003
Distribution: Slackware 10
Posts: 56

Rep: Reputation: 15
yeah, makes sense, but he might just be browsing through the logs, and doesn't like some access to some ports or something, and wants to ban that computer for good measure...
 
Old 02-26-2004, 07:37 PM   #11
aufwiedersehen
LQ Newbie
 
Registered: Feb 2004
Posts: 1

Rep: Reputation: 0
How would one be able to block a range of ip's like say i wanted to block 12.34.*.* how can this be done?
 
Old 02-27-2004, 12:02 AM   #12
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 57
To block entire subnets like that:

If you wanted to block all of 12.x.x.x, it would be 12.0.0.0/8
12.34.x.x would be: 12.34.0.0/16
12.34.56.x would be 12.34.56.0/24
And to block one IP with that notation it would be 12.34.56.78/32
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
MEPISlovers banning certain people? galen Linux - Distributions 10 12-15-2004 12:47 AM
banning IP addresses in samba HedAche Linux - Networking 4 07-02-2004 04:01 PM
banning an ip im1crazyassmofo Linux - General 18 04-10-2003 10:07 AM


All times are GMT -5. The time now is 09:50 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration