lexington
02-22-2004, 05:37 PM
Hello, I am completely new to doing this, could you explain in detail how I can ban an IP range from accessing my server? Every single minute I receive automated emails from my firewall saying that an IP such as 66.98.69.112 was attacking my host and it was dropped, I assume if I were to ban the IP range of:
66.98.60.167 -> 66.98.188.208
I would no longer get those emails?
RiderMayBail
02-22-2004, 05:54 PM
I could be wrong, so someone please correct me if I am, but if your firewall is picking up these attacks and dropping them, then it is doing its job properly. To be able to block the IP any further out you would need access to the router. To do any scripting in regards to blocking a specific IP range, you would have to let it get behind the firewall.
Perhaps I am way off base here.
Another option to do is do a ARIN whois lookup on the IP and send something to the abuse address. That may get you nowhere, but it may help.
Arising Sun
02-22-2004, 06:45 PM
Or you can try to report this attack to the proper authorities with evidence supported.
lexington
02-22-2004, 06:47 PM
I tried that with someone in the past and nothing ever happens, I could get a death threat and would never receive a response.
FatalSw1tch
02-22-2004, 06:52 PM
Contact your ISP and ask them if they have any idea of why you might be getting this to your address. YOu could be a victom of someone attacking the pervious owner of that IP
Uncle Mad
02-23-2004, 02:30 AM
I don't know, but i once heard a friend saying to toggle with some IPtables or something? Not much idea on it.
But he tested this on me, requesting for my IP, then he configure something, and i can no longer access to his website, not even ping his server.
Perhaps someone has got this expertise here, which i'm also pretty interested.
Well blocking the range with IPtables would serve SOME function because those addresses still could hit valid ports that are open (i.e. web server, ssh)...