[SOLVED] How do I block this site in iptables?

lucmove · 09-09-2020, 12:48 PM

Quote:

Originally Posted by Turbocapitalist

For archival and access purposes can you please post it here within [code] [/code] tags? Thanks in advance.

Isn't pastebin a better home for such a long piece of code?

Turbocapitalist · 09-09-2020, 12:51 PM

Not if you want people to read it. There is also a lot to be said for keeping all the discussion and the code in the same place. Pastebin links expire quickly, so the link will be dead sooner or later, and there's no telling how long that site as whole will be around. LQ posts will be around as long as LQ is around and that's what matters in this context.

berndbausch · 09-09-2020, 07:07 PM

Quote:

Originally Posted by lucmove

Code:

# curl -i waterfox.net
HTTP/1.1 308 Permanent Redirect
Connection: close
Location: https://waterfox.net/
Server: Caddy
Date: Wed, 09 Sep 2020 15:17:15 GMT
Content-Length: 0

Code:

# curl -i 51.159.31.11
no output; it hangs

So you can block the site's IP address, as evidenced by the second curl command. When you use the site's DNS name, traffic is not blocked. Which tells me that the first curl command above resolves waterfox.net to a different IP address.

The only different IP address that I can find is 2001:bc8:6005:1b:dac4:97ff:fe2a:2ec0. So, try again after adding this rule to the OUTPUT chain:

Code:

iptables6 -I OUTPUT -d 2001:bc8:6005:1b:dac4:97ff:fe2a:2ec0/128 -j DROP

(I can't test this because I don't have IPv6 enabled right now)

lucmove · 09-09-2020, 08:42 PM

Quote:

Originally Posted by Turbocapitalist

For archival and access purposes can you please post it here within [code] [/code] tags? Thanks in advance.

I tried.

Quote:

The following errors occurred with your submission:
The text that you have entered is too long (76480 characters). Please shorten it to 30000 characters long.

lucmove · 09-09-2020, 08:43 PM

Quote:

Originally Posted by berndbausch

The only different IP address that I can find is 2001:bc8:6005:1b:dac4:97ff:fe2a:2ec0. So, try again after adding this rule to the OUTPUT chain:

Code:

iptables6 -I OUTPUT -d 2001:bc8:6005:1b:dac4:97ff:fe2a:2ec0/128 -j DROP

I don't have iptables6 and it doesn't seem to be available in the Debian repository.

jefro · 09-09-2020, 08:54 PM

Side note.

http://fwbuilder.sourceforge.net/ might ease your building rules.

Thoughts.
Browser cache clear.
Ideally router would block.
Set hosts file for address to bad name and a 0.0.0.0 address. This may not work on some types of proxy.

berndbausch · 09-10-2020, 12:51 AM

Quote:

Originally Posted by lucmove

I don't have iptables6 and it doesn't seem to be available in the Debian repository.

Then you need to figure out how to add rules for IPvv6 to your firewall.

Turbocapitalist · 09-10-2020, 01:04 AM

It's spelled differently. Try the spelling recommended in #9 above, or check the first page or so of the manual page for iptables.

Again, and I'll admit to nagging, after this is done please take a look at NFtables.

lucmove · 09-10-2020, 03:46 PM

This fixed the problem:

Code:

iptables6 -I OUTPUT -d 2001:bc8:6005:1b:dac4:97ff:fe2a:2ec0/128 -j DROP

I found that iptables6 in Debian is ip6tables. Grumble.

So:

Code:

ip6tables -I OUTPUT -d 2001:bc8:6005:1b:dac4:97ff:fe2a:2ec0/128 -j DROP

That really blocks the site I wanted to. Solved.

Note: I investigated NFtables and fwbuilder, and found both way too complicated for me. Maybe they seem 'simple' if you're used to iptables and know what you're doing. Neither is my case. I felt very helpeless at all the material that I read. I installed fwbuilder and found it very difficult to understand, never mind to use. That firewall script I shared on Pastebin has done the job for me for many years.

Thank you all. I appreciate the help.

Turbocapitalist · 09-10-2020, 09:26 PM

Great that it's working. One thing which will increase the speed would be to use REJECT as a target instead of DROP on the outgoing packets. Otherwise it is you who has to wait for the connection to time out.