How do I Drop or block attackers IP with null routes?

by LinuxTitli on May 25, 2006 · 27 comments

Someone might attack on your system. You can drop attacker IP using IPtables. However, you can use route command to null route unwanted traffic. A null route (also called as blackhole route) is a network route or kernel routing table entry that goes nowhere. Matching packets are dropped (ignored) rather than forwarded, acting as a kind of very limited firewall. The act of using null routes is often called blackhole filtering.

You can nullroute (like some time ISP do prevent your network device from sending any data to a remote system.) stopping various attacks coming from a single IP (read as spammers or hackers):

Nullroute IP using route command

Suppose that bad IP is 65.21.34.4, type following command at shell:

# route add 65.21.34.4 gw 127.0.0.1 lo

You can verify it with following command:
# netstat -nr
OR
# route -n
You can also use reject target (thanks to Gabriele):
# route add -host IP-ADDRESS reject
# route add -host 64.1.2.3 reject

To confirm the null routing status, use ip command as follows:
# ip route get 64.1.2.3
Output:

RTNETLINK answers: Network is unreachable

Drop entire subnet 192.67.16.0/24:
# route add -net 192.67.16.0/24 gw 127.0.0.1 lo
You can also use ip command to null route network or ip, enter:
# ip route add blackhole 202.54.5.2/29
# route -n

How do I remove null routing? How do I remove blocked IP address?

Simple use router delete command,
# route delete 65.21.34.4
This is cool, as you do not have to play with iptables rules.

See also:

Updated for accuracy.

Featured Articles:

Share this with other sys admins!
Facebook it - Tweet it - Print it -

We're here to help you make the most of sysadmin work. So, subscribe!

{ 27 comments… read them below or add one }

1 timmy May 27, 2006

Heh, it’s kinda nice feature, since it works, and isn’t something you just think of… I guess most people would block it in a FW…

Thnaks…

Reply

2 Rohit Basu February 22, 2008

Its a temporary solution…

the parmanent one is th find all the ips which acts as an attacker and to use the rule for all.

make a shell script for this.

use netstat to find out max no. of connection by each ip short them out and apply the above rule for all of them.

Reply

3 Gabriele Callari February 23, 2008

Nice idea, perhaps something like

route add 65.21.34.4 reject

will do the same more elegantly?

Reply

4 Ian May 3, 2010

the reject is not more elegant, it’s better to black hole them certainly for discouraging attackers as they have to wait for a timeout for a response

Reply

5 vivek February 23, 2008

Gabriele,

The post has been updated. Thanks for pointing out reject option.

Reply

6 Gabriele Callari February 27, 2008

Thanks to you for the great site, and please note that, as the man page for route says, “This is NOT for firewalling”.

Reply

7 James March 30, 2008

i tried this
route add 65.21.34.4 gw 127.0.0.1 lo

and it fails on XP with the message
route: bad gateway address gw

same error with this
route add 65.21.34.4 reject

route: bad gateway address gw

copied exactly as you have posted
any ideas ?

Reply

8 vivek March 30, 2008

James,

These instructions only tested on Linux.

Reply

9 carlos June 5, 2008

please note that syntaxis is different for the route command from linux to windows, but using the right syntaxis surely it must work.

I think that all we know that this kind of measures are when we are in a hurry, not a definitive solution.

Even though they can be a lifesaver on occasions.

thanks for your work.

Reply

10 carlos June 5, 2008

by the way …

Does somebody know what is the difference between the use of reject and the use of …. 127.0.0.1 blackhole?

thanks.

Reply

11 vivek June 5, 2008

reject – send “Network is unreachable” message back to client.

blackhole – No message sent back to client

Reply

12 carlos June 5, 2008

thanks.. Vivek.
this is important to me, because I have to decide between this two commands.

..say… What would be more adecuate to a hacker?

receive a message saying “network is unreachable” or no message at all?

maybe “network is unreachable”?

or… no message…

I am thinking. Any suggestion?

Reply

13 Kirrus September 13, 2008

Carlos: Blackhole is better.

Reply

14 SeBas January 23, 2009

I could not delete the rejected ip with the command given in the tutorial. I’m running Debian.
# route delete 10.0.0.19
SIOCDELRT: No such process

But I was able to delete the rejected ip route with this command:
# route del -host 10.0.0.19 reject

Cheers,

Reply

15 Adam March 26, 2009

I liked the command used by SeBas to remove the block….

It worked for me:
route del -host 10.0.0.19 reject

got something to learn

Reply

16 zsentient April 1, 2009

So to make this persistent across reboots, what is the syntax for the /etc/sysconfig/network/routes file?

Reply

17 Vivek Gite April 1, 2009

Add commands to /etc/rc.local file.

Reply

18 zsentient April 1, 2009

Thanks Vivek, not the answer I was looking for, but I am sure that would work:)

Reply

19 chika May 20, 2009

drop entire subnet
# route add -net 192.67.16.0/24 gw 127.0.0.1 lo

how to enable again?

Reply

20 Damien Jorgensen August 1, 2009

Its sad how easy it is to forget simple commands like this when you dont use them everyday

Thanks for the blog, saved me a lot of hassle and now null routing works a treat

Damien

Reply

21 Haji August 28, 2009

Hi,
I want to Block inetnum range IP like 58.208.0.0 – 58.223.255.255 via route add -net command. which command must we use?

Reply

22 Vivek Gite August 29, 2009

Use iptables.

Reply

23 Haji August 29, 2009

Please give me the iptables usage for that.

Reply

24 Jackie October 22, 2010

Awesome tutorial! But when you reboot routes are erased.

Reply

25 Benny February 10, 2011

Take a look at ifroute.

Reply

26 Mr.Hien April 2, 2011

Using routing policy database (RPDB) maybe work same!
Try it:

ip rule add blackhole to 65.21.34.4

Reply

27 Piet April 10, 2011

I use this entry in a script.
route add -net 85.90.162.0 netmask 255.255.255.0 reject

But how can I drop this entry without booting my machine?

Reply

Leave a Comment

You can use these HTML tags and attributes for your code and commands: <strong> <em> <ol> <li> <u> <ul> <blockquote> <pre> <a href="" title="">
What is 12 + 10 ?
Please leave these two fields as-is:
Are you a human being? Solve the simple math so we know that you are a human and not a bot.




Previous post:

Next post: