Hi there,

I'm very new to Linux, and Linux networking in particular, so sorry if I get some terms or other stuff wrong here .

I would like to block all traffic from and to a specific IP address and port (on the local LAN) from our internet server which is running Red Hat 5.2 .

As far as I can tell, the server is using "ipchains" (don't know exactly what it does, but was told I should look there for this). 've tried reading up on this online but the guides and docs I've found assume you already know quite a bit about Linux networking, which I don't.


Basically, I need to be able to quickly block traffic to/from xxx.xxx.xxx.xxxort and then 'unblock' it easily again later.


Thanks for any help.

How are you collecting the ip numbers/ports?

There are several dynamic IDS systems available that can be told to look for specific patterns and respond to them...
eg http://www.psionic.com/products/portsentry.html
which I have working in a RH6.2 machine...
It adds rules like this...
-A input -s 80.32.93.74/255.255.255.255 137:137 -d 0.0.0.0/0.0.0.0 -p 1 -j DENY