Linux Null route an attackers ip

Q. How do I null route an attakers IP under Red Hat Enterprise Linux? I would like to block unwanted traffic from a particular source.

ADVERTISEMENTS

A. A null route is a network route that goes nowhere. When a network packet is received by Linux (or UNIX or any other network device) operating system, it needs to route that packet somewhere. It uses the routing table to decide where to send the packet. To kill the packet, in essence dropping the packet and forbidding the packet from travelling further, a nullroute could be put in place.

There are two ways to achieve the same.
First find out attacker IP address from system log files such as
=> /var/log/messages
=> /var/log/secure
=> /var/log/auth

Use tail -f command to view incoming messages
# tail -f /var/log/messages
You can also use faillog command or combination of grep and awk to find out list of failed ssh login attempt.

Option #1: Using Iptables

Use following iptables rules:
# iptables --append INPUT --source IP-ADDRESS -j DROP

Add above rules to your iptables shell script. To drop bunch of IPs use something as follows in your shell script:
BADIPS="64.56.1.2 69.51.11.21 1.2.3.4"
for i in $BADIPS
do
iptables --append INPUT --source $i -j DROP
done

Option # 2: Using route command

See previous article for more information.

🐧 Get the latest tutorials on SysAdmin, Linux/Unix, Open Source/DevOps topics:
CategoryList of Unix and Linux commands
File Managementcat
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network Utilitiesdig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04

ADVERTISEMENTS
0 comments… add one

Leave a Reply

Your email address will not be published.

Use HTML <pre>...</pre>, <code>...</code> and <kbd>...</kbd> for code samples.