Comments on: How do I Drop or block attackers IP with null routes? http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html This is a Linux sys admin journal by Vivek about sys admin work, Linux tips & tricks, hacks, news and more. Fri, 10 Feb 2012 20:37:43 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Piethttp://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-170547 Piet Sun, 10 Apr 2011 07:30:56 +0000 http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-170547 I use this entry in a script. route add -net 85.90.162.0 netmask 255.255.255.0 reject But how can I drop this entry without booting my machine? I use this entry in a script.
route add -net 85.90.162.0 netmask 255.255.255.0 reject

But how can I drop this entry without booting my machine?

]]> By: Mr.Hienhttp://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-170441 Mr.Hien Sat, 02 Apr 2011 14:58:00 +0000 http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-170441 Using routing policy database (RPDB) maybe work same! Try it: <blockquote>ip rule add blackhole to 65.21.34.4</blockquote> Using routing policy database (RPDB) maybe work same!
Try it:

ip rule add blackhole to 65.21.34.4

]]> By: Bennyhttp://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-168690 Benny Thu, 10 Feb 2011 16:42:03 +0000 http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-168690 Take a look at ifroute. Take a look at ifroute.

]]> By: Jackiehttp://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-160350 Jackie Fri, 22 Oct 2010 09:23:06 +0000 http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-160350 Awesome tutorial! But when you reboot routes are erased. Awesome tutorial! But when you reboot routes are erased.

]]> By: Ianhttp://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-155523 Ian Mon, 03 May 2010 22:32:48 +0000 http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-155523 the reject is not more elegant, it's better to black hole them certainly for discouraging attackers as they have to wait for a timeout for a response the reject is not more elegant, it’s better to black hole them certainly for discouraging attackers as they have to wait for a timeout for a response

]]> By: Hajihttp://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-150413 Haji Sat, 29 Aug 2009 10:35:19 +0000 http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-150413 Please give me the iptables usage for that. Please give me the iptables usage for that.

]]> By: Vivek Gitehttp://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-150409 Vivek Gite Sat, 29 Aug 2009 06:07:47 +0000 http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-150409 Use iptables. Use iptables.

]]> By: Hajihttp://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-150405 Haji Fri, 28 Aug 2009 17:49:06 +0000 http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-150405 Hi, I want to Block inetnum range IP like 58.208.0.0 - 58.223.255.255 via route add -net command. which command must we use? Hi,
I want to Block inetnum range IP like 58.208.0.0 – 58.223.255.255 via route add -net command. which command must we use?

]]> By: Damien Jorgensenhttp://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-149821 Damien Jorgensen Sat, 01 Aug 2009 20:08:43 +0000 http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-149821 Its sad how easy it is to forget simple commands like this when you dont use them everyday Thanks for the blog, saved me a lot of hassle and now null routing works a treat Damien Its sad how easy it is to forget simple commands like this when you dont use them everyday

Thanks for the blog, saved me a lot of hassle and now null routing works a treat

Damien

]]> By: chikahttp://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-148640 chika Wed, 20 May 2009 21:42:34 +0000 http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-148640 drop entire subnet # route add -net 192.67.16.0/24 gw 127.0.0.1 lo how to enable again? drop entire subnet
# route add -net 192.67.16.0/24 gw 127.0.0.1 lo

how to enable again?

]]> By: zsentienthttp://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-147937 zsentient Wed, 01 Apr 2009 18:51:54 +0000 http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-147937 Thanks Vivek, not the answer I was looking for, but I am sure that would work:) Thanks Vivek, not the answer I was looking for, but I am sure that would work:)

]]> By: Vivek Gitehttp://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-147936 Vivek Gite Wed, 01 Apr 2009 18:20:06 +0000 http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-147936 Add commands to /etc/rc.local file. Add commands to /etc/rc.local file.

]]> By: zsentienthttp://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-147935 zsentient Wed, 01 Apr 2009 18:01:56 +0000 http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-147935 So to make this persistent across reboots, what is the syntax for the /etc/sysconfig/network/routes file? So to make this persistent across reboots, what is the syntax for the /etc/sysconfig/network/routes file?

]]> By: Adamhttp://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-147868 Adam Thu, 26 Mar 2009 18:11:04 +0000 http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-147868 I liked the command used by SeBas to remove the block.... It worked for me: route del -host 10.0.0.19 reject got something to learn I liked the command used by SeBas to remove the block….

It worked for me:
route del -host 10.0.0.19 reject

got something to learn

]]> By: SeBashttp://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-146858 SeBas Fri, 23 Jan 2009 17:17:23 +0000 http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-146858 I could not delete the rejected ip with the command given in the tutorial. I'm running Debian. # route delete 10.0.0.19 SIOCDELRT: No such process But I was able to delete the rejected ip route with this command: # route del -host 10.0.0.19 reject Cheers, I could not delete the rejected ip with the command given in the tutorial. I’m running Debian.
# route delete 10.0.0.19
SIOCDELRT: No such process

But I was able to delete the rejected ip route with this command:
# route del -host 10.0.0.19 reject

Cheers,

]]> By: Kirrushttp://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-144996 Kirrus Sat, 13 Sep 2008 19:47:32 +0000 http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-144996 Carlos: Blackhole is better. Carlos: Blackhole is better.

]]> By: carloshttp://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-143980 carlos Thu, 05 Jun 2008 23:37:01 +0000 http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-143980 thanks.. Vivek. this is important to me, because I have to decide between this two commands. ..say... What would be more adecuate to a hacker? receive a message saying "network is unreachable" or no message at all? maybe "network is unreachable"? or... no message... I am thinking. Any suggestion? thanks.. Vivek.
this is important to me, because I have to decide between this two commands.

..say… What would be more adecuate to a hacker?

receive a message saying “network is unreachable” or no message at all?

maybe “network is unreachable”?

or… no message…

I am thinking. Any suggestion?

]]> By: vivekhttp://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-143979 vivek Thu, 05 Jun 2008 22:36:43 +0000 http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-143979 reject - send "Network is unreachable" message back to client. blackhole - No message sent back to client reject – send “Network is unreachable” message back to client.

blackhole – No message sent back to client

]]> By: carloshttp://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-143976 carlos Thu, 05 Jun 2008 21:50:43 +0000 http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-143976 by the way ... Does somebody know what is the difference between the use of reject and the use of .... 127.0.0.1 blackhole? thanks. by the way …

Does somebody know what is the difference between the use of reject and the use of …. 127.0.0.1 blackhole?

thanks.

]]> By: carloshttp://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-143975 carlos Thu, 05 Jun 2008 21:47:41 +0000 http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html#comment-143975 please note that syntaxis is different for the route command from linux to windows, but using the right syntaxis surely it must work. I think that all we know that this kind of measures are when we are in a hurry, not a definitive solution. Even though they can be a lifesaver on occasions. thanks for your work. please note that syntaxis is different for the route command from linux to windows, but using the right syntaxis surely it must work.

I think that all we know that this kind of measures are when we are in a hurry, not a definitive solution.

Even though they can be a lifesaver on occasions.

thanks for your work.

]]>