Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a router running Linux. Its network configuration has a default route to my ISP for public Internet access. I now need to prevent a specified destination network from access.

Original route table:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         172.16.6.254    0.0.0.0         UG    0      0        0 eth0.2
10.99.0.0       *               255.255.255.0   U     0      0        0 tap0

Assuming 74.1.1.0/24 is the network which I want to forbid routing. I hope every client connected to this router gets 'Network unreachable' for an address in that network.

Is there anyway to do this?

share|improve this question
    
null route the network on the default gateway. –  Hennes Aug 5 '13 at 13:36
    
    
@GregoryA.Lussier , thanks for your link. However, the client just report 'timeout' instead of 'destination network unreachable'. –  Lingfeng Xiong Aug 5 '13 at 15:03
    
Then use the REJECT target of iptables, see this link: linuxtopia.org/Linux_Firewall_iptables/x4550.html –  Gregory A. Lussier Aug 5 '13 at 15:33
add comment

3 Answers

up vote 3 down vote accepted

Use iproute2.

ip route add unreachable 74.1.1.0/24

In this case, if you're trying to deny outbound traffic to that network, it's better to use routing to deny that network, rather than netfilter. For inbound, it's more idiomatic to use netfilter, as in another answer here, but with --src instead of --dst, and had better use ICMP admin prohibited, or just drop instead. You can use the RPDB (see ip-rule(8), to achieve the same effect but likely will look out of place.

Don't use ifconfig, route, or other tools from the net-tools package; they're long deprecated.

You can confirm what the router itself will use as the routing decision.

$ ip route get 74.1.1.0/24
RTNETLINK answers: Network is unreachable

Note that the 'get' verb is not the same as 'show' (or 'list'), as it 'calculates' the routing decision rather than just filtering and listing entries in the routing table.

Hosts on your side of the network will get ICMP destination net unreachable.

$ ping 74.1.1.1 -c 1
PING 74.1.1.1 (74.1.1.1) 56(84) bytes of data.
From 172.16.6.254 icmp_seq=1 Destination Net Unreachable

--- 74.1.1.1 ping statistics ---
1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0.7ms
$ echo $?
1

If the userspace involved is defective and hangs rather than returning an error immediately, that's another problem. The kernel can't compensate for such buggy userspace.

share|improve this answer
add comment

You can use netfilter

iptables -A FORWARD --dst 74.1.1.0/24 -j REJECT --reject-with icmp-net-unreachable

man iptables says the following about the --reject-with option

--reject-with type
     The type given can be icmp-net-unreachable, icmp-host-unreachable,
     icmp-port-unreachable,  icmp-proto-unreachable,  icmp-net-prohibited,
     icmp-host-prohibited  or  icmp-admin-prohibited  (*)  which  return  the
     appropriate  ICMP  error  message (port-unreachable is the default).  The
     option tcp-reset can be used on rules which only match the TCP protocol:
     this causes a TCP RST packet to be sent back.  This is mainly useful for
     blocking ident (113/tcp) probes which frequently occur when sending mail to
     broken mail hosts (which won't accept your mail otherwise)
share|improve this answer
add comment

Add a route pointing to lo for that subnet:

route add -net 74.1.1.0/24 gw 127.0.0.1 lo

The ip command has a blackhole parameter I just found out about:

ip route add blackhole 74.1.1.0/24

Read more.

Looks like there's a reject option - see if that does what you need:

route add -net 74.1.1.0/24 reject

share|improve this answer
1  
A blackhole route will silently drop the packets sent to destination network instead return 'destination network unreachable' :-( –  Lingfeng Xiong Aug 5 '13 at 15:04
    
See above edits. –  ultrasawblade Aug 5 '13 at 15:39
    
Yes, looks like it..! –  Gregory A. Lussier Aug 5 '13 at 15:45
    
@ultrasawblade I tried that command and it seems the clients just reports 'timed out' instead the expected 'network unreachable' :-( –  Lingfeng Xiong Aug 5 '13 at 16:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.