Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a router running Linux. Its network configuration has a default route to my ISP for public Internet access. I now need to prevent a specified destination network from access.

Original route table:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         UG    0      0        0 eth0.2       *        U     0      0        0 tap0

Assuming is the network which I want to forbid routing. I hope every client connected to this router gets 'Network unreachable' for an address in that network.

Is there anyway to do this?

share|improve this question
null route the network on the default gateway. – Hennes Aug 5 '13 at 13:36
@GregoryA.Lussier , thanks for your link. However, the client just report 'timeout' instead of 'destination network unreachable'. – Lingfeng Xiong Aug 5 '13 at 15:03
Then use the REJECT target of iptables, see this link: – Gregory A. Lussier Aug 5 '13 at 15:33
up vote 3 down vote accepted

Use iproute2.

ip route add unreachable

In this case, if you're trying to deny outbound traffic to that network, it's better to use routing to deny that network, rather than netfilter. For inbound, it's more idiomatic to use netfilter, as in another answer here, but with --src instead of --dst, and had better use ICMP admin prohibited, or just drop instead. You can use the RPDB (see ip-rule(8), to achieve the same effect but likely will look out of place.

Don't use ifconfig, route, or other tools from the net-tools package; they're long deprecated.

You can confirm what the router itself will use as the routing decision.

$ ip route get
RTNETLINK answers: Network is unreachable

Note that the 'get' verb is not the same as 'show' (or 'list'), as it 'calculates' the routing decision rather than just filtering and listing entries in the routing table.

Hosts on your side of the network will get ICMP destination net unreachable.

$ ping -c 1
PING ( 56(84) bytes of data.
From icmp_seq=1 Destination Net Unreachable

--- ping statistics ---
1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0.7ms
$ echo $?

If the userspace involved is defective and hangs rather than returning an error immediately, that's another problem. The kernel can't compensate for such buggy userspace.

share|improve this answer

You can use netfilter

iptables -A FORWARD --dst -j REJECT --reject-with icmp-net-unreachable

man iptables says the following about the --reject-with option

--reject-with type
     The type given can be icmp-net-unreachable, icmp-host-unreachable,
     icmp-port-unreachable,  icmp-proto-unreachable,  icmp-net-prohibited,
     icmp-host-prohibited  or  icmp-admin-prohibited  (*)  which  return  the
     appropriate  ICMP  error  message (port-unreachable is the default).  The
     option tcp-reset can be used on rules which only match the TCP protocol:
     this causes a TCP RST packet to be sent back.  This is mainly useful for
     blocking ident (113/tcp) probes which frequently occur when sending mail to
     broken mail hosts (which won't accept your mail otherwise)
share|improve this answer

Add a route pointing to lo for that subnet:

route add -net gw lo

The ip command has a blackhole parameter I just found out about:

ip route add blackhole

Read more.

Looks like there's a reject option - see if that does what you need:

route add -net reject

share|improve this answer
A blackhole route will silently drop the packets sent to destination network instead return 'destination network unreachable' :-( – Lingfeng Xiong Aug 5 '13 at 15:04
See above edits. – LawrenceC Aug 5 '13 at 15:39
Yes, looks like it..! – Gregory A. Lussier Aug 5 '13 at 15:45
@ultrasawblade I tried that command and it seems the clients just reports 'timed out' instead the expected 'network unreachable' :-( – Lingfeng Xiong Aug 5 '13 at 16:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .