Block IP

[thias]

How can I block IP addresses in this wonderful router?

greetz

[barsju]

You need to read up on iptables: http://iptables-tutorial.frozentux.net/iptables-tutorial.html

Then you should put your iptables-rules in /usr/local/sbin/post-firewall
Or you can make a script that reads ip's from a file and ads the rules automatically.

B.

[thias]

I'm not advanced in linux at all. This will be hard for me, still I'd like to try. Maybe you could give me a few basic hints how to do this? Do I use the hidden admin for this?

The author of the Ip-tables document states the following: The new iptables is a good upgrade from the old ipchains in this regard. With ipchains, you could make a fairly secure network by dropping all incoming packages not destined for given ports. However, things like passive FTP or outgoing DCC in IRC would cause problems.

Do you think this might have something to do with my thread of 05-04-2005 "Cannot get PASV ftp transfer to work for ppl also behind router" <--no solution yet:-(

Any hint on these issues would greatly be appreciated.

[barsju]

Do I use the hidden admin for this?
No. This is best to do using telnet.

So 1. find out how to telnet to your router.
2. Find a little tutorial on vi (text editor)
3. Make a text file with all the ipadresses you want to block ex. "vi /usr/local/etc/block.ip"
4. Read iptables tutorial and find out what exactly you want to block. Traffic from ip to/from router? Traffic between LAN pc and IP? TCP? UDP?
5. Make a script file ex '/usr/local/sbin/blockIPs' with something like this:


#!/bin/sh
for ip in `cat /usr/local/etc/block.ip`
do
iptables -A FORWARD -p tcp -s $ip -j DROP
iptables -A FORWARD -p udp -s $ip -j DROP
done

6. Make file executable: "chmod +x /usr/local/sbin/blockIPs"
7. Test script: "./usr/local/sbin/blockIPs", and check iptables: 'iptables -L FORWARD'
8. If ok, add to post-firewall:
'echo "/usr/local/sbin/blockIPs" >> /usr/local/sbin/post-firewall'
9. Make post-firewall executable: 'chmod +x /usr/local/sbin/post-firewall'
10. Save and commit to flash: 'flashfs save' 'flashfs commit'
11. If not already enabled: 'flashfs enable'
12. Reboot.
13. Check iptables 'iptables -L FORWARD'

Well that should get you started atleast.
S.

[lukie]

Thanks for your helpful instruction barsju. It almost worked in my case.
The for-loop didn't work properly. This worked well:


#!/bin/sh
for ip in $(cat /usr/local/etc/block.ip)
do
iptables -A FORWARD -s $ip -j DROP
done

I also removed the protocol setting. Now i can block unwanted websites. :D