Iptables Drop IP Address

How do I block particular IP addresses or host with the iptables command under Linux?

You need to use the following syntax to drop an IP address or host with the iptables command.

WARNING! These examples may block your computer if not executed with proper care. Be careful when applying these settings on remote servers over ssh session.

Block Incoming Request From IP

The following command will drop any packet coming from the IP address

/sbin/iptables -I INPUT -s {IP-HERE} -j DROP
/sbin/iptables -I INPUT -s -j DROP

You can also specify an interface such as eth1 via which a packet was received:

/sbin/iptables -I INPUT -i {INTERFACE-NAME-HERE} -s {IP-HERE} -j DROP
/sbin/iptables -I INPUT -i eth1 -s -j DROP

Please note that when the “!” argument is used before the interface name, the sense is inverted:

/sbin/iptables -I INPUT ! -i {INTERFACE-NAME-HERE} -s {IP-HERE} -j DROP
/sbin/iptables -I INPUT ! -i eth1 -s -j DROP

If the interface name ends in a “+”, then any interface which begins with this name will match. If this option is omitted, any interface name will match:

/sbin/iptables -I INPUT  -i {INTERFACE-NAME-HERE}+ -s {IP-HERE} -j DROP
/sbin/iptables -I INPUT  -i br+ -s -j DROP

You can replace -I INPUT (insert) with -A INPUT (append) rule as follows:

/sbin/iptables -A INPUT  -s -j DROP
/sbin/iptables -i eth1 -A INPUT  -s -j DROP

How Do I Block Subnet (xx.yy.zz.ww/ss)?

Use the following syntax to block on eth1 public interface:
# /sbin/iptables -i eth1 -A INPUT -s -j DROP

How Do I Block and Log Dropped IP Address Information?

You can turn on kernel logging of matching packets with LOG target as follows:
# /sbin/iptables -i eth1 -A INPUT -s -j LOG --log-prefix "IP DROP SPOOF A:"
The next rule will actually drop the ip / subnet:
# /sbin/iptables -i eth1 -A INPUT -s -j DROP

How Do I View Blocked IP Address?

Simply use the following command:
# /sbin/iptables -L -v
# /sbin/iptables -L INPUT -v
# /sbin/iptables -L INPUT -v -n
Sample outputs:

Chain INPUT (policy ACCEPT 3107K packets, 1847M bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  br+    any              anywhere            
    0     0 DROP       all  --  !eth1  any              anywhere            
    0     0 DROP       all  --  !eth1  any              anywhere       

How Do I Search For Blocked IP Address?

Use the grep command as follows:
# /sbin/iptables -L INPUT -v -n | grep

How Do I Delete Blocked IP Address?

First, you need to display blocked IP address along with line number and other information, enter:
# iptables -L INPUT -n --line-numbers
# iptables -L INPUT -n --line-numbers | grep

Sample outputs:

num   pkts bytes target     prot opt in     out     source               destination
1        0     0 DROP       0    --  *      *
2        0     0 DROP       0    --  *      *
3        0     0 DROP       0    --  *      *

To delete line number 3 (, enter:
# iptables -D INPUT 3
Verify the same, enter:
# iptables -L INPUT -v -n
You can also use the following syntax:
# iptables -D INPUT -s -j DROP

How Do I Save Blocked IP Address?

If you are using Redhat / RHEL / CentOS / Fedora Linux, type the following command:
# iptables -D INPUT -s -j DROP
#////// command to save iptables ///////#
# /sbin/service iptables save
# less /etc/sysconfig/iptables
# grep '' /etc/sysconfig/iptables

For all other Linux distributions use the iptables-save command to dump the contents of an IP Table to a file:
# iptables-save > /root/myfirewall.conf
Please not that you need to run the ‘iptables-save’ or ‘service iptables save’ as soon as you add or delete the ip address.

A Note About Restoring Firewall

To restore your firewall use the iptables-restore command to restore IP Tables from a file called /root/myfirewall.conf, enter:
# iptables-restore < /root/myfirewall.conf

How Do I Block Large Number Of IP Address or Subnets?

You need to write a shell script as follows:

$IPT -N droplist
egrep -v "^#|^$" x | while IFS= read -r ip
	$IPT -A droplist -i eth1 -s $ip -j LOG --log-prefix "IP BlockList "
	$IPT -A droplist -i eth1 -s $ip -j DROP
done < "$_input"
# Drop it
$IPT -I INPUT -j droplist
$IPT -I OUTPUT -j droplist
$IPT -I FORWARD -j droplist

See also: iptables: Read a List of IP Address From File And Block

Block Outgoing Request From LAN IP

Use the following syntax:
# /sbin/iptables -A OUTPUT -s -j DROP
# /sbin/service iptables save

You can also use FORWARD default chainswhen packets send through another interface. Usually FORWARD used when you setup Linux as a router:
# /sbin/iptables -A FORWARD -s -j DROP
# /sbin/service iptables save

Posted by: SXI ADMIN

The author is the creator of SXI LLC and a seasoned sysadmin, DevOps engineer, and a trainer for the Linux operating system/Unix shell scripting. Get the latest tutorials on SysAdmin, Linux/Unix and open source topics via RSS/XML feed or weekly email newsletter.

Leave a Reply

Your email address will not be published. Required fields are marked *

Previous Post

How to Make Website WCAG Compliant?

Next Post

Link download Kali Linux 2020.1 (ISO + Torrent)

Related Posts