firewall rule or host.allow

Super7 · 08-09-2006, 04:10 PM

I have been watching my logs and I have some guy tryn to get at my DNS server, which I dont even have :| makes sense no? anyhow I want to block his whole class C address range.

How should I go about this, I have shorewall as my firewall which is working well right now. I see it dropping the packets but I dont want that in my logs anymore I just want to cut him off. Is there a rule in shorewall to deny all always, or should I just deny him in hosts.allow?

Thanks

win32sux · 08-09-2006, 04:51 PM

you could use a simple iptables command like (example):

Code:

iptables -I INPUT -s 200.200.200.200/24 -j DROP

(replace 200.200.200.200/24 with his actual subnet) this makes any incoming packets from the guy's subnet to get sent to DROP, without logging them...

Super7 · 08-09-2006, 05:58 PM

ahhh thanks did the trick I am gonna do that for all the people that go after port 53 or the gnutella one.