0

I recently found out how to "block" an IP address from your computer, with this command:

sudo iptables -A INPUT -s 210.1.193.49 -j DROP #Blocks 210.1.193.49 from your computer

I was wondering, how could I do this for ALL hosts on the network, not only my machine.

I am running Kali Linux.

SCENARIO: Lets say my "Internet Cafe" is suffering from a DoS attack. If I want to block the IP address that is sending me packets, how would I do so?

BREAKDOWN: Attacker is using Low Orbit Ion Cannon to DoS my Network, using my PUBLIC IP address (Attacker is from outside the network) I want to block the attackers IP address from reaching my network

closed as off-topic by Steffen Ullrich, Xiong Chiamiov, Steve, Stephane, Dmitry Grigoryev Apr 4 '17 at 16:04

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    I think you need to look at the concept of a perimeter firewall which protects a whole network instead of applying filter rules at each system in the network. – Steffen Ullrich Apr 1 '17 at 11:09
  • I've heard about using ARP poisoning, would this work? Kali Linux comes with ettercap, or even arpspoof. – Python Apr 1 '17 at 11:10
  • 2
    ARP level filtering or ARP poising does not work against attacks from outside. I think you are missing some basic concepts of how networks work, but explaining these is off-topic here. – Steffen Ullrich Apr 1 '17 at 11:11
  • Can you use iptables to block an IP? Yes. Can you run the same command on all machines in your network? Yes, if they have iptables. Can you use iptables on the router to block an IP from your network? Yes, if the router has iptables. Can you run iptables on one machine to magically protect all the rest of the network? No, unless it is a boundary firewall. – schroeder Apr 1 '17 at 11:15
  • 1
    Re: edit, you need a boundary firewall, then you can block IPs at that point. – schroeder Apr 1 '17 at 11:16
0

If I understand you correctly, you want to launch a MITM on incoming traffic from an external IP to all potential internal nodes, thereby making your Kali machine a filtering firewall for your network.

Sure, you could do this, just like any ettercap scenario, if you can get the border gateway to see you as all destination nodes and send all incoming traffic to you. Just like any ARP spoof use case, you can choose to mess with the traffic however you want (drop, manipulate, record, etc.).

There are several technical barriers to do this. First, your machine becomes a bottleneck. You would have to process all incoming traffic, and choose to pass it on or drop it. When you add in your ARP spoofing, your machine will be very busy and might tip over. Second, you would have to process all outgoing traffic, too, to make sure the router doesn't record the other nodes' real destinations. Add that to what your machine would have to do.

I'm not sure if any of this would be 100% successful.

1

If you want to block traffic to a whole network you have to do it at the network border. In the simplest case of a network with a single connection to the Internet (typical home network) this would be the Internet router. Most home routers have a GUI allowing you to add this kind of rules, often under the heading "Firewall".

Alternatively you can perform the iptables command you quoted (or its equivalent for other operating systems) on every host in the network. This may prove impractical or impossible depending on the number and types of hosts in your network.

Not the answer you're looking for? Browse other questions tagged or ask your own question.