0

How could I filter a single IP address or a range of IP addresses to prevent them from accessing my computer?

Examples:

  1. Block 31.13.76.102

  2. Block from 216.58.192.0 to 216.58.223.255

  3. Block from 173.194.0.0 to 173.194.255.255

  4. Block from 74.125.136.0 to 74.125.136.255

I would like to block them from accessing my computer without additionnal conditions.

I know that one can use iptables in this situation, but I am unaware of the exact syntax, how to make the changes permanent, and which command to run in order to launch the iptables service at startup. I also don't want to make mistakes that may break my access to the Internet.

  • OK for filtering rules. Thank you for all the repliers. Now does someone know which addresses range to target for getting rid of advertisements on spotifi free accounts ? Thank you everyone. – Thierry Mar 6 '18 at 0:33
3

While you could use /etc/hosts.deny, hosts.deny only works with TCP wrapped applications such as ssh or xinetd. I would recommend using iptablessince it is a true firewall to your system. Just use something like this:

iptables -I INPUT -s 31.13.76.102 -j DROP
iptables -I INPUT -m iprange --src-range 216.58.192.0-216.58.223.255 -j DROP
iptables -I INPUT -m iprange --src-range 173.194.0.0-173.194.255.255 -j DROP
iptables -I INPUT -m iprange --src-range 74.125.136.0-74.125.136.255 -j DROP
iptables-save > /etc/sysconfig/iptables

The iprange is a really cool module to use for situations such as this.

  • Thank you for your answer Jaken551. Three more questions please : #0 Should I start Iptables on my system before typing the filtering rules, if yes how ? #1 What is the command to start iptables at each boot (I run Majaro, an Arch-Linux based distribution whose init system is systemd) ? #2 There is no /etc/sysconfig directory on my defaukt configuration, which command do I have to type to make the filtration rules permanent ? – Thierry Mar 5 '18 at 19:41
  • #0: You can edit the iptables rules whether or not the service is running, starting it is up to you. #1: Run systemctl enable iptables in order to have iptables service start at boot. #2: For Arch-Linux the iptables config file is /etc/iptables/iptables.rules. Unfortunately, this is not created by default with Arch, but running the iptables-save /etc/iptables/iptables.rules will create it for you :) Best of luck to you! – Jaken551 Mar 5 '18 at 21:30
  • Thank you for your answer Jaken551. It does filter the targets BUT ranges seem far too large and block part of interesting targets wheraes I only want to target advertisements... – Thierry Mar 6 '18 at 0:27
  • What exactly are you trying to block? This is only blocking incoming connections. If you are trying to block advertisements, firewall rules are not really what you want. – Jaken551 Mar 6 '18 at 7:11
  • Yes, I want to block spotifi ad-server to get rid of commercials on the free account through the spotify application.. The problem is finding a reliable list of addresses to block. I found the mentionned-above one on reddit, but its seems to be far too obstructing. Searching with 'spotify' ad-servers' list' on Internet didnt return anything up-to-date and reliable so far for me. If you have any info, you are welcome. Some are mentionned on github but its not perfect... Maybe its possible to find it using tools like wireshark but I dont know enough to use it properly. Thank you again. – Thierry Mar 6 '18 at 7:34
0

Simply add the following to /etc/hosts.deny:

ALL: 31.13.76.102
ALL: 216.58.192.0/19
ALL: 173.194.0.0/16
ALL: 74.125.136.0/24
0

The ufw command (Uncomplicated FireWall, a simplified front-end for iptables, initially for Ubuntu, now also available for Debian and other distros) accepts CIDR range specifications, for instance:

ufw insert 1 deny from 31.13.76.102 # single address
ufw insert 1 deny from 216.58.192.0/18 # range

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.