How to block sites with iptables

Question

I would like to block sites using iptables. How do I go about this, and how do I ensure that the iptables rules are saved?

Answer 1

Blocking sites with iptables rules is a very bad idea, mainly because iptables (as most firewalls) deals with the IP addresses, and relationship between a site and its IP address(es) is rather loose:

1. One site can have many IP addresses, which can be changed rather frequently. Once iptables rules are created, even if you specify a site's name as part of a rule, the first IP address at that moment is used. If site's address changes, your iptables rules will be out of date.

2. One IP address can host many sites (and it happens often). This will only get more frequent, because of the IP address scarcity. If you block an IP address, you block all sites hosted on it.

So, even though other answers explain how you do it, I urge you to seek some other solution. For example, installing a transparent http proxy will achieve what you need. This transparent HTTP proxy HOWTO is a bit outdated, but it will help you get started.

Once you have a transparent proxy, you can add arbitrary rules to it to block specific sites, you don't even need to use the caching feature of squid, if you don't want it.

There are other ways to handle site blocking (other firewalls, proxies, etc.), but iptables rules is pretty much one of the worst possible ways to handle it.

Answer 2

Under gentoo, to save the iptables rules you have added, use

/etc/init.d/iptables save

However, you'll also need to make sure that the iptables init script (whose purpose is to reload the rules) is run at boot:

rc-update add iptables default 

Both commands should be run as root (via sudo if you have it installed)

Answer 3

ok, Lets say you want to block the IP address 192.168.1.5, just enter this at command prompt in your shell script:

iptables -A INPUT -s 192.168.1.5 -j DROP

Then you can block outoging IP address 192.168.1.2 from the server with this command:

iptables -A OUTPUT -d 192.168.1.2  -j DROP

and it should block that site from ever bothering you again. hope this helps.