Block Website from Centos IP Tables? (OpenVPN)

sethl · 03-08-2015, 04:02 PM

Okay, so I have a small VPN and I received an abuse report due to port scanning on a website. I wish to block the website entirely from ever being accessed again to prevent this problem.

How would I go about blocking the website?

I have tried a few things that don't seem to work so I made an account here, thank you.

smallpond · 03-08-2015, 04:59 PM

To drop all packets to the website, you can insert a rule like this, where x.x.x.x is the IP address returned by host.

Code:

host www.example.com
iptables -I INPUT 1 -d "x.x.x.x" -j DROP

After you've tested that it is what you want, use iptables-save to make it stay through reboots.

sethl · 03-09-2015, 12:09 PM

What if I wanted to block a site like facebook with many IP addresses?

smallpond · 03-09-2015, 03:32 PM

Do they?

Code:

host www.facebook.com
www.facebook.com is an alias for star.c10r.facebook.com.
star.c10r.facebook.com has address 31.13.71.1
star.c10r.facebook.com has IPv6 address 2a03:2880:f012:1:face:b00c:0:1
star.c10r.facebook.com mail is handled by 10 msgin.vvv.facebook.com.

unSpawn · 03-09-2015, 06:54 PM

Quote:

Originally Posted by smallpond

Do they?

Facebook itself actually has AS32934 which right now contains 45 IP ranges. That's not to say they use them all but it also doesn't say they won't ever. Also it doesn't take any distributed ^.*whatever.*$ networks usage into account. Some things are better blocked on multiple levels and including a filtering proxy.

smallpond · 03-10-2015, 08:07 AM

The OP said they want to block the site, not all IPs owned by FB.

Miati · 03-10-2015, 11:25 AM

Quote:

Okay, so I have a small VPN and I received an abuse report due to port scanning on a website. I wish to block the website entirely from ever being accessed again to prevent this problem.

Quote:

To drop all packets to the website, you can insert a rule like this, where x.x.x.x is the IP address returned by host.

Code:

host www.example.com
iptables -I INPUT 1 -d "x.x.x.x" -j DROP

Perhaps I misread, but I believe the OP is asking to prevent packets being sent to the address, not received
While x.x.x.x wouldn't be able to connect to you, I think someone using the VPN could connect to website x and continue port scanning.

Code:

iptables -I OUTPUT 1 -d "x.x.x.x" -j REJECT

It may serve to reject the packet as well, to let the user know that this behaviour is being restricted (or at least know that it's blocked)

Additionally, the OP says the abuse report was from a port scan, is there any reason to not just reject all traffic to any ports except 443,80 for this website?
It's a little more complicated but I wouldn't want to be claimed for censorship for the other users (just a thought)
If it's a complex site and uses more ports, this probably won't work but for a simple site it could.

Code:

iptables -I OUTPUT 1 -d x.x.x.x -m multiport ! --dport 80,443 -j REJECT

This will reject the packet if sent to destination x.x.x.x and is to any port except 80 or 443.

smallpond · 03-10-2015, 11:47 AM

If blocking at a firewall for a LAN, then the rule should go in the FORWARDING chain. Also add it to the OUTPUT chain to block packets from the local machine.

jakep219 · 03-23-2015, 06:11 PM

Although you inquired about an iptables based block, you may open /etc/hosts file in your favorite text editor as root and redirect the domain name to a non-existant IP address or (if you are particularly evil) redirect the domain to the ip address of a different server that you may or may not have complete control over.

Add a line like this to the hosts file and save.

Quote:

127.0.0.1 facebook.com