CS & IT Solutions

What is iptable? Iptables is a generic table structure that defines rules and commands as part of the netfilter framework that facilitates Network Address Translation (NAT), packet filtering, and packet mangling in the Linux 2.4 and later operating systems. NAT is the process of converting an Internet Protocol address (IP address) into another IP address. Packet filtering is the process of passing or blocking packets at a network interface based on source and destination addresses, ports, or protocols. Packet mangling is the ability to alter or modify packets before and/or after routing.

Iptables and netfilter are the successor to ipchains and ipfwadm in earlier versions of Linux. Netfilter and iptables are often combined into the single expression netfilter /iptables, which refers to the Linux 2.4 and later subsystems for NAT, firewall, and advanced packet processing.

How do I block an IP address or subnet under Linux operating system?

In order to block an IP on your Linux server you need to use iptables tools (administration tool for IPv4 packet filtering and NAT) and netfilter firewall. First you need to log into shell as root user. To block IP address you need to type iptables command as follows:
Syntax to block an IP address under Linux

Replace IP-ADDRESS with actual IP address. For example if you wish to block ip address 65.55.44.100 for whatever reason then type command as follows:

If you have IP tables firewall script, add above rule to your script.

If you just want to block access to one port from an ip 65.55.44.100 to port 25 then type command:
# iptables -A INPUT -s 65.55.44.100 -p tcp –destination-port 25 -j DROP
The above rule will drop all packets coming from IP 65.55.44.100 to port mail server port 25.

You can also create Security Shell Script to block the ips: Create /root/iptables/blocked.ips file as follows with list of ips and subnets to block entering your dedicated server.

So if you want PF to do only one thing, and that is to block particular ip’s here is how you do it. Keep in mind, this configuration is a horrible idea for a traditional firewall. So first begin with creating /etc/pf.conf, I use vi, you can use whatever.

ext_if=”re0″ # External interface

#Block all Ip’s in the banned table
table { 192.168.1.1 }
block quick from to any
block quick from any to

pass out keep state
pass in quick on ext_if

conf if your looking for a traditional firewall, this is for the sole purpose of blocking a single IP or IP ranges.

You will need to replace re0 with your interface name and put your IP’s to be blocked in the banned table.

You can put entire classes of IP’s if you want like: 204.152.64.0/23
and the table should be comma seperated so something like:

table { 192.168.1.1, 204.152.64.0/23 }

Also to get pf.conf to start(FreeBSD, anyway), you need to put this in the rc.conf:

pf_enable=”YES”
pf_rules=”/etc/pf.conf”
pf_flags=”"
pflog_enable=”YES”
pflog_logfile=”/var/log/pflog”
pflog_flags=”"

I’ll go more in depth on more stuff you can do with pf in the next post, or wait, maybe a powershell post, I don’t know. I am not promising anything.

source here