How Do I Drop or Block Attackers IP Address With Null Routes On a Linux?

Posted on in Categories Iptables, Linux, Security last updated May 25, 2006

Someone might attack your Linux based system. You can drop attacker IP using IPtables. However, you can use the route or ip command to null route unwanted traffic. A null route (also called as blackhole route) is a network route or kernel routing table entry that goes nowhere. Matching packets are dropped (ignored) rather than forwarded, acting as a kind of very limited firewall. The act of using null routes is often called blackhole filtering.

You can null route (like some time ISP do prevent your network device from sending any data to a remote system) stopping various attacks coming from a single IP (read as spammers or hackers IP) using the following syntax on a Linux based system.

Nullroute IP using route command

Suppose that bad IP is 65.21.34.4, type the following command at shell:
# route add 65.21.34.4 gw 127.0.0.1 lo
You can verify it with the following command:
# netstat -nr
OR
# route -n
You can also use reject target (a hat tip to Gabriele):
# route add -host IP-ADDRESS reject
# route add -host 64.1.2.3 reject

To confirm the null routing status, use the ip command as follows:
# ip route get 64.1.2.3
Output:

RTNETLINK answers: Network is unreachable

To drop entire subnet 192.67.16.0/24, type:
# route add -net 192.67.16.0/24 gw 127.0.0.1 lo

Null routing using ip command

While traversing the RPDB, any route lookup which matches a rule with the blackhole rule type will cause the packet to be dropped. No ICMP will be sent and no packet will be forwarded. The syntax is follows for the ip command:
# ip route add blackhole 202.54.5.2/29
# ip route add blackhole from 202.54.1.2
# ip rule add blackhole to 10.18.16.1/29
# ip route

How do I remove null routing? How do I remove blocked IP address?

Simple use the route delete command as follows:
# route delete 65.21.34.4
OR
# route del -host 65.21.34.4 reject
Or use NA command to delete route:
# ip route delete 1.2.3.4/26 dev eth0

This is cool, as you do not have to play with iptables rules as described here.

See also:

Posted by: Vivek Gite

The author is the creator of nixCraft and a seasoned sysadmin and a trainer for the Linux operating system/Unix shell scripting. He has worked with global clients and in various industries, including IT, education, defense and space research, and the nonprofit sector. Follow him on Twitter, Facebook, Google+.

41 comment

  1. Heh, it’s kinda nice feature, since it works, and isn’t something you just think of… I guess most people would block it in a FW…

    Thnaks…

  2. Its a temporary solution…

    the parmanent one is th find all the ips which acts as an attacker and to use the rule for all.

    make a shell script for this.

    use netstat to find out max no. of connection by each ip short them out and apply the above rule for all of them.

    1. the reject is not more elegant, it’s better to black hole them certainly for discouraging attackers as they have to wait for a timeout for a response

  3. Thanks to you for the great site, and please note that, as the man page for route says, “This is NOT for firewalling”.

  4. i tried this
    route add 65.21.34.4 gw 127.0.0.1 lo

    and it fails on XP with the message
    route: bad gateway address gw

    same error with this
    route add 65.21.34.4 reject

    route: bad gateway address gw

    copied exactly as you have posted
    any ideas ?

  5. please note that syntaxis is different for the route command from linux to windows, but using the right syntaxis surely it must work.

    I think that all we know that this kind of measures are when we are in a hurry, not a definitive solution.

    Even though they can be a lifesaver on occasions.

    thanks for your work.

  6. by the way …

    Does somebody know what is the difference between the use of reject and the use of …. 127.0.0.1 blackhole?

    thanks.

  7. thanks.. Vivek.
    this is important to me, because I have to decide between this two commands.

    ..say… What would be more adecuate to a hacker?

    receive a message saying “network is unreachable” or no message at all?

    maybe “network is unreachable”?

    or… no message…

    I am thinking. Any suggestion?

  8. I could not delete the rejected ip with the command given in the tutorial. I’m running Debian.
    # route delete 10.0.0.19
    SIOCDELRT: No such process

    But I was able to delete the rejected ip route with this command:
    # route del -host 10.0.0.19 reject

    Cheers,

  9. I liked the command used by SeBas to remove the block….

    It worked for me:
    route del -host 10.0.0.19 reject

    got something to learn

  10. So to make this persistent across reboots, what is the syntax for the /etc/sysconfig/network/routes file?

  11. Its sad how easy it is to forget simple commands like this when you dont use them everyday

    Thanks for the blog, saved me a lot of hassle and now null routing works a treat

    Damien

  12. Hi,
    I want to Block inetnum range IP like 58.208.0.0 – 58.223.255.255 via route add -net command. which command must we use?

  13. I use this entry in a script.
    route add -net 85.90.162.0 netmask 255.255.255.0 reject

    But how can I drop this entry without booting my machine?

  14. fail2ban is a solution worth looking into. If on a fedora based distro you will need epel repositories. Install with apt-get on debian or yum on fedora/CenOS etc.
    Works fine, lasts a long time.

  15. i getting this error after deleting null rout IP: already routed

    [[email protected] ~]# route delete xxx.xx.xx.xx
    SIOCDELRT: No such process
    [[email protected] ~]#

  16. Using a null route is all good if you know the source IP range, but it quickly becomes unmanageable for an internet facing server. A better and more automated solution is fail2ban. Then configure the /etc/jail.conf file for the service you are protecting. In my case I have it protecting an SSH server. After 3 failed login attempts it automatically configures iptables to deny any new connections from the source IP.

    It has lots of options like permanently banning a source address or just blocking it for a short time frame. Exceptions and logging can be configured as well. Blocking after 3 failed attempts is enough to thwart most attacks.

  17. Do you understand what the line actually do?
    route add 65.21.34.4 gw 127.0.0.1 lo

    When packet is received from 65.21.34.4 it always get connected to the host (if you not doped the package with iptables) it is processed and when it have to send the answer to 65.21.34.4 with the needed data the static route tell to forward this package to the loopback interface, so the package never come back to the 65.21.34.4 (bad attacker host)

    Please correct me if i’m wrong.
    Thanks ๐Ÿ˜‰

  18. I don’t see the point of this, unless you don’t have iptables – a stretch. And the truth is, it is not significantly simpler than iptables, at what it does.

  19. Nice trick but…

    Not 100% sure but redirecting traffic to 127.0.0.1 will redirect incoming packets to all programs listening on 127.0.0.1. So for example incoming packets will reach mysql listening on 127.0.0.1. Some programs are somewhat protected by listening only on 127.0.0.1 and not on 0.0.0.0. I would prefer the blackhole line over the redirect…

    Depending on firewall rules like iptables then you could have a real mess if you NAT all outgoing traffic.

    Last point this is also dependant on ip_forward = 1.

    I would prefer a good firewall configuration on top of blackhole if this is really needed.

    my two cents…

    Have fun!

  20. Automatic dynamic blocking

    ipset create banned_hosts hash:net family inet hashsize 65536 maxelem 200000 counters comment

    iptables -A input_ext -m set -j DROP --match-set banned_hosts src
    iptables -A input_ext -p tcp -m tcp -m multiport -m state --state NEW -j ban_me ! --dports 25,80,443
    ipset save >/somewhere/ipset
    ipset restore </somewhere/ipset

  21. the “ip route” command does not support “from” and “to” keywords. The following does not work:
    # ip route add blackhole from 202.54.1.2
    # ip rule add blackhole to 10.18.16.1/29

Comments are closed.