Block incoming IP

[mbeijen]

For some reason, my router doesn't allow me to block an IP address.

I would like to block an IP from accessing my router/network.

I am using : ASUS RT-N66W with latest 374.40 build.

Any suggestions?

Thanks,
Marco

 

[mbeijen]

This is what iptables look like right now:

iptables -L

Chain INPUT (policy ACCEPT)
target prot opt source destination
DROP all -- 5.153.50.107-static.reverse.softlayer.com anywhere
DROP all -- anywhere anywhere state INVALID
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere state NEW
ACCEPT all -- anywhere anywhere state NEW
ACCEPT udp -- anywhere anywhere udp spt:bootps dpt:bootpc
DROP all -- anywhere anywhere

Chain FORWARD (policy DROP)
target prot opt source destination
DROP all -- 5.153.50.107-static.reverse.softlayer.com anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
DROP all -- anywhere anywhere
DROP all -- anywhere anywhere state INVALID
ACCEPT all -- anywhere anywhere
DROP icmp -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate DNAT
ACCEPT all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain FUPNP (0 references)
target prot opt source destination

Chain PControls (0 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain logaccept (0 references)
target prot opt source destination
LOG all -- anywhere anywhere state NEW LOG level warning tcp-sequence tcp-options ip-options prefix `ACCEPT '
ACCEPT all -- anywhere anywhere

Chain logdrop (0 references)
target prot opt source destination
LOG all -- anywhere anywhere state NEW LOG level warning tcp-sequence tcp-options ip-options prefix `DROP '
DROP all -- anywhere anywhere

With this one, connections are still coming through...

 

[thelonelycoder]

Just use the IP Address part 5.153.50.107 to drop.

 

[mbeijen]

Thanks for the anwer, however, iptables only uses IP's.

See:

admin@ROUTER:/tmp/home/root# iptables -L -n

Chain FORWARD (policy DROP)
target prot opt source destination
DROP all -- 5.153.50.107 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
DROP all -- 0.0.0.0/0 0.0.0.0/0
DROP all -- 0.0.0.0/0 0.0.0.0/0 state INVALID
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
DROP icmp -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate DNAT
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0

 

[thelonelycoder]

It's a reverse, use 107.50.153.5

 

[mbeijen]

It's not a reverse, I contacted the abuse department of the IP in question (5.153.50.107) and within 5 minutes the attack stopped.

However, I still would like to be able to stop this myself on router level.

 

[thelonelycoder]

Is the rule actually active?
Enter

service restart_firewall

or reboot Router