Arch Linux

vxsa4

Member

Registered: 2020-10-11

Posts: 1

Block access to an IP

One of my applications is making connections to Google I'm not sure why. I verified this by looking at

$ sudo netstat -atupen

tcp        0      0 <p>:36038    172.217.166.110:443     ESTABLISHED 1000       133785     6456/perl 

Doing a `whois` against that gives:

NetRange:       172.217.0.0 - 172.217.255.255
CIDR:           172.217.0.0/16

I want to block all connections to and from that IP or IP range (172.217.0.0/16) such that no packets are sent or received.

How would I do this using UFW or IPtables and how can I verify that any IP in the range 172.217.0.0 - 172.217.255.255 is getting blocked?

I read the wiki portion but I'm not sure how to write a rule. At least I cannot undrstand if it is working because I cannot see anything being blocked printed in journalctl and the websites are still reachable if I typ the IP on a browser.

solskog

Member

Registered: 2020-09-05

Posts: 462

Re: Block access to an IP

# iptables -A INPUT -s  172.217.0.0/16 -m state --state NEW,RELATED,ESTABLISHED -j DROP
# iptables -A OUTPUT -d  172.217.0.0/16 -m state --state NEW,RELATED,ESTABLISHED -j DROP

the websites are still reachable if I typ the IP on a browser.

A browser firefox/chrome are smart enough that allways find a way out. Use tcpdump or wireshark to investigate further.

Last edited by solskog (2020-10-11 11:05:19)