ip route add unreachable 220.127.116.11/24
In this case, if you're trying to deny outbound traffic to that network, it's better to use routing to deny that network, rather than netfilter. For inbound, it's more idiomatic to use netfilter, as in another answer here, but with
--src instead of
--dst, and had better use ICMP admin prohibited, or just drop instead. You can use the RPDB (see
ip-rule(8), to achieve the same effect but likely will look out of place.
Don't use ifconfig, route, or other tools from the
net-tools package; they're long deprecated.
You can confirm what the router itself will use as the routing decision.
$ ip route get 18.104.22.168/24
RTNETLINK answers: Network is unreachable
Note that the 'get' verb is not the same as 'show' (or 'list'), as it 'calculates' the routing decision rather than just filtering and listing entries in the routing table.
Hosts on your side of the network will get ICMP destination net unreachable.
$ ping 22.214.171.124 -c 1
PING 126.96.36.199 (188.8.131.52) 56(84) bytes of data.
From 172.16.6.254 icmp_seq=1 Destination Net Unreachable
--- 184.108.40.206 ping statistics ---
1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0.7ms
$ echo $?
If the userspace involved is defective and hangs rather than returning an error immediately, that's another problem. The kernel can't compensate for such buggy userspace.