Home › Forums › BlockHosts

Using blockhosts with iptables

Mon, 2007–Dec–03

I am running blockhosts on Gentoo 2006.1. I want to block at the network layer, and I want to do so with iptables instead of null routing. Well, to make a long story short, I enabled this in my /etc/blockhosts.cfg file :

IPBLOCK = "iptables -A blockhosts -i ! eth1 --source -j DROP"

Needless to say it doesn't like that, I think it is something to do with the option but I do not know any other way to wildcard so that it will use blocked ip addresses as the source. When I comment out the option, and I run /usr/bin/blockhosts.py --ipblock="iptables", it successfully adds a chain called blockhosts, and adds a DENY rule for every address blocked. It also adds a rule at the top of the INPUT chain telling it to check the blockhosts chain (INPUT -j blockhosts). Problem with this, is I don't know the rule it is using to block with, I assume it is a simple DENY everything from this IP rule. Is there some sort of default rule it is using? How is this working without the ipblock area of the cfg file defined?

‹ blockhosts email notification question Blockhost 2.0.6 ›
Tue, 2007-12-11 14:17 — ac

details on ipblock

blockhosts.py --help will describe in detail the arguments accepted for --ipblock, and yes, it only accepts iptables or "ip route".

Then blockhosts.py follows the following method to create the blocking chain:
# use a user-defined iptables chain, named as SCRIPT_ID ("blockhosts")
# a rule is added to the INPUT chain to jump to the blockhosts chain
# the blockhosts chain uses DROP action for each blocked IP address

So, the rule applied is: iptables --append blockhosts --source %s -j DROP
where --source is passed the IP address of the host to be blocked.

You can see all the rules in effect by running this command:
iptables --list blockhosts --numeric