A more general solution than Laurentiu Roescu's would be to use iptables, which works the same in every distribution and essentially regardless of which software is installed.
# iptables -A INPUT -p tcp -s <ip_address> --dport telnet -j DROP
You may optionally use
-j REJECT instead of
-j DROP. Using REJECT will tell whoever is at the other end that there is nothing on that particular port; using DROP will drop the packet, which leads to the connection attempt timing out after the remote host's connect timeout interval has passed.
It's possible that you will need to insert the rule before any "ACCEPT" rules that may already be in place. If so, I like to do it like this:
# iptables -L INPUT --line-number
<some or lots of output>
# iptables -I INPUT <number of telnet accept rule> ...
... is everything from
-p tcp onward in the command above. Essentially,
-I INPUT n replaces
-A INPUT. (-I is insert just before position n, -A is append.)
You can use
--dport telnet because
telnet is listed in /etc/services. Try
grep telnet /etc/services if you are curious. If it weren't, you'd have to use the numerical port number, which is
You may need to use something like
iptables-save to preserve the rule across reboots. The details on that will depend on your distribution and setup, and thus cannot be answered generally. If you specify your distribution and version, someone may be able to offer specific insights as to that (or it may work better as a separate question "how do I preserve iptables rules across reboots in Distribution X Version Y?").
That said, I agree with that one should use SSH instead. But you still may want to block access from certain IPs, and the lower level at which that can be done, the less you risk a bug in a higher-level portion of the stack leading to a compromise or denial of service.