Is it safe to use the
/etc/hosts file as a website blocking "null" address?
I would argue the answer should be: No.
If for no other reason than the requests are not actually "nulled". They are still active requests. And as the OP indicates, since the requests are for legitimate Internet hosts, this sort of short cut method of redirecting requests to
localhost may interfere with testing networking code in a development environment.
Perhaps a better method of blocking traffic to and from certain Internet hosts, is to utilize
iptables which is the interface to the Linux kernel's firewall.
iptables is the default networking rule table for most GNU/Linux systems. Some distros use
ufw as a front-end to
If you want to use
iptables, here's a simple script which will
DROP all incoming and outgoing packets for a list of IP addresses or hostnames with one address or hostname per line contained in a plain text file called
## Block every IP address in ~/blocking.txt
## DROP incoming packets to avoid information leak about your hosts firewall
## (HT to Conor Mancone) REJECT outgoing packets to avoid browser wait
for i in $(cat ~/blocking.txt); do
echo "Blocking all traffic to and from $i"
/sbin/iptables -I INPUT -s $i -j DROP
/sbin/iptables -I OUTPUT -d $i -j REJECT
Do not place your
localhost IP addresses in this file.
While reassigning Internet hosts to
localhost in the
/etc/hosts file is a common short cut technique to block unwanted Internet hosts, this method has some serious security drawbacks.
Incoming requests which were not purposefully initiated via a specific user request. The most common example is ads on webpages. Let's follow the incoming packets...
First, I start up
wireshark. Then I place the biggest Internet ad company in my
/etc/hosts file with this line:
And then disable all ad blockers in my browser, navigate to
youtube and play any random video.
If I filter my packets, broadly including Google's IP address space:
I am still receiving packets from Google.
What does this mean?
It means that there is a possibility of a malicious server inserting malware which may be able to attack my computing platform via packets that are still arriving and sent to localhost. The use of
/etc/hosts rather than dropping or rejecting the packets via the firewall rules, is a poor security measure. It does not block incoming packets from possible malicious hosts, nor does it provide effective feedback for trouble shooting purposes.
Outgoing requests which are sent to
localhost rather than being rejected or dropped by the firwall rules are still being processed by the kernel. There are a few undesirable actions that occur when
/etc/hosts is used rather than the firewall:
Extra processing is occurring when the outgoing packet hits localhost. For example, if a webserver is running on the host, the packet sent to localhost may be processed by the webserver.
The feedback from outgoing requests may become confusing if the
/etc/hosts is populated with certain domains.
iptables can handle lots of rules
According to some:
ServerFault: How many rules can iptables support
A possible theoretical limit on a 32-bit machine is 38 million rules. However, as noted in the referenced post, as the
iptables rule list expands so does the needed kernel memory.