Blocking IP addresses in Linux with iptables
Block IP addresses in Linux (with iptables and ipset)
Most system administrators will already be familiar with iptables. It is around for quite a while, and by default enabled within the Linux kernel. Within this article we are going to configure iptables to block one or multiple IP addresses. This may come in handy when you get repeating port scans or see failed login attempts in your log files.
Check existing iptables configuration
The first step is to validate existing iptables rules. We will use an empty ruleset for test purposes.
Manually blocking a single IP address
The first option to permanently block an IP address is by creating a rule in the INPUT chain. This way traffic is no longer allowed from that particular IP address.
iptables -I INPUT -s 192.168.1.100 -j DROP
Although this option works great, it might not scale very well. You might even get a very long list of IP addresses to block after a while. Let’s have a look at ipset.
Using blacklists with iptables and ipset
Another option is creating a blacklist. This way we can add multiple systems we no longer want to connect to our systems.
Install ipset utility
Most Linux systems do not have the ipset utility installed by default. So first install that toolkit.
yum install ipset
You may need to install the epel-release package first.
Debian and Ubuntu
apt-get install ipset
Creating a blacklist
With the newly installed ipset utility we create a new list. We name it blacklist to show its purpose.
# Create blacklist with ipset utility (once) ipset create blacklist hash:ip hashsize 4096
After the blacklist is created, we can use the set in iptables. It is related to the –match-set option.
# Set up iptables rules. Match with blacklist and drop traffic iptables -I INPUT -m set --match-set blacklist src -j DROP iptables -I FORWARD -m set --match-set blacklist src -j DROP
These commands will add the blacklist (or set) to the INPUT and FORWARD chains. As this is a blacklist, the related policy is to drop traffic. No output will be displayed when entering the commands.
Adding IP addresses to block
Next step is adding actual IP address to the list:
# Add a specific IP address to your newly created blacklist ipset add blacklist 192.168.1.100
To confirm the blacklist contains the IP address, use the ipset list command.
In this screenshot, we can see the IP address is listed as a member of the set. Now traffic should be blocked.
When setting up a blacklist like this, always test it. You want to be sure that the blacklist is enforced in your specific configuration.