≡ Menu

Iptables Drop IP Address

How do I block particular IP addresses or host with the iptables command under Linux?

You need to use the following syntax to drop an IP address or host with the iptables command.

WARNING! These examples may block your computer if not executed with proper care. Be careful when applying these settings on remote servers over ssh session.

Block Incoming Request From IP

The following command will drop any packet coming from the IP address

/sbin/iptables -I INPUT -s {IP-HERE} -j DROP
/sbin/iptables -I INPUT -s -j DROP

You can also specify an interface such as eth1 via which a packet was received:

/sbin/iptables -I INPUT -i {INTERFACE-NAME-HERE} -s {IP-HERE} -j DROP
/sbin/iptables -I INPUT -i eth1 -s -j DROP

Please note that when the "!" argument is used before the interface name, the sense is inverted:

/sbin/iptables -I INPUT ! -i {INTERFACE-NAME-HERE} -s {IP-HERE} -j DROP
/sbin/iptables -I INPUT ! -i eth1 -s -j DROP

If the interface name ends in a "+", then any interface which begins with this name will match. If this option is omitted, any interface name will match:

/sbin/iptables -I INPUT  -i {INTERFACE-NAME-HERE}+ -s {IP-HERE} -j DROP
/sbin/iptables -I INPUT  -i br+ -s -j DROP

You can replace -I INPUT (insert) with -A INPUT (append) rule as follows:

/sbin/iptables -A INPUT  -s -j DROP
/sbin/iptables -i eth1 -A INPUT  -s -j DROP

How Do I Block Subnet (xx.yy.zz.ww/ss)?

Use the following syntax to block on eth1 public interface:
# /sbin/iptables -i eth1 -A INPUT -s -j DROP

How Do I Block and Log Dropped IP Address Information?

You can turn on kernel logging of matching packets with LOG target as follows:
# /sbin/iptables -i eth1 -A INPUT -s -j LOG --log-prefix "IP DROP SPOOF A:"
The next rule will actually drop the ip / subnet:
# /sbin/iptables -i eth1 -A INPUT -s -j DROP

How Do I View Blocked IP Address?

Simply use the following command:
# /sbin/iptables -L -v
# /sbin/iptables -L INPUT -v
# /sbin/iptables -L INPUT -v -n
Sample outputs:

Chain INPUT (policy ACCEPT 3107K packets, 1847M bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  br+    any              anywhere
    0     0 DROP       all  --  !eth1  any              anywhere
    0     0 DROP       all  --  !eth1  any              anywhere       

How Do I Search For Blocked IP Address?

Use the grep command as follows:
# /sbin/iptables -L INPUT -v -n | grep

How Do I Delete Blocked IP Address?

First, you need to display blocked IP address along with line number and other information, enter:
# iptables -L INPUT -n --line-numbers
# iptables -L INPUT -n --line-numbers | grep

Sample outputs:

num   pkts bytes target     prot opt in     out     source               destination
1        0     0 DROP       0    --  *      *
2        0     0 DROP       0    --  *      *
3        0     0 DROP       0    --  *      *

To delete line number 3 (, enter:
# iptables -D INPUT 3
Verify the same, enter:
# iptables -L INPUT -v -n
You can also use the following syntax:
# iptables -D INPUT -s -j DROP

How Do I Save Blocked IP Address?

If you are using Redhat / RHEL / CentOS / Fedora Linux, type the following command:
# iptables -D INPUT -s -j DROP
#////// command to save iptables ///////#
# /sbin/service iptables save
# less /etc/sysconfig/iptables
# grep '' /etc/sysconfig/iptables

For all other Linux distributions use the iptables-save command to dump the contents of an IP Table to a file:
# iptables-save > /root/myfirewall.conf
Please not that you need to run the 'iptables-save' or 'service iptables save' as soon as you add or delete the ip address.

A Note About Restoring Firewall

To restore your firewall use the iptables-restore command to restore IP Tables from a file called /root/myfirewall.conf, enter:
# iptables-restore < /root/myfirewall.conf

How Do I Block Large Number Of IP Address or Subnets?

You need to write a shell script as follows:

$IPT -N droplist
egrep -v "^#|^$" x | while IFS= read -r ip
	$IPT -A droplist -i eth1 -s $ip -j LOG --log-prefix "IP BlockList "
	$IPT -A droplist -i eth1 -s $ip -j DROP
done < "$_input"
# Drop it
$IPT -I INPUT -j droplist
$IPT -I OUTPUT -j droplist
$IPT -I FORWARD -j droplist

See also: iptables: Read a List of IP Address From File And Block

Block Outgoing Request From LAN IP

Use the following syntax:
# /sbin/iptables -A OUTPUT -s -j DROP
# /sbin/service iptables save

You can also use FORWARD default chainswhen packets send through another interface. Usually FORWARD used when you setup Linux as a router:
# /sbin/iptables -A FORWARD -s -j DROP
# /sbin/service iptables save

{ 4 comments… add one }

  • pablo valenciano June 30, 2012, 2:14 am

    iptables -A INPUT -s xxx.xxx.xxx.xxx -j DROP

    Where xxx.xxx.xxx.xxx its the IP address that you need block.

  • milap April 16, 2014, 11:54 am

    Hi I have trying to block an ip address
    /sbin/iptables -I INPUT -s -j DROP

    It inserts the records

    But it shows the record as

    pkts bytes target prot opt in out source destination
    0 0 DROP all — any any cross.gr anywhere

    It shows cross.gr in place of ip

    What am i missing , help is very much apriciated thanks

  • Tom November 1, 2015, 10:43 am

    Really good tutorial. My Google searches gave me all kinds of spurious results. This one however, is a model of clarity. Thank you!

Leave a Comment

   Tagged with: , , , , , , , , , , , , ,