ip route add unreachable 18.104.22.168/24
In this case, if you're trying to deny outbound traffic to that network, it's better to use routing to deny that network, rather than netfilter. For inbound, it's more idiomatic to use netfilter, as in another answer here, but with
--src instead of
--dst, and had better use ICMP admin prohibited, or just drop instead. You can use the RPDB (see
ip-rule(8), to achieve the same effect but likely will look out of place.
Don't use ifconfig, route, or other tools from the
net-tools package; they're long deprecated.
You can confirm what the router itself will use as the routing decision.
$ ip route get 22.214.171.124/24
RTNETLINK answers: Network is unreachable
Note that the 'get' verb is not the same as 'show' (or 'list'), as it 'calculates' the routing decision rather than just filtering and listing entries in the routing table.
Hosts on your side of the network will get ICMP destination net unreachable.
$ ping 126.96.36.199 -c 1
PING 188.8.131.52 (184.108.40.206) 56(84) bytes of data.
From 172.16.6.254 icmp_seq=1 Destination Net Unreachable
--- 220.127.116.11 ping statistics ---
1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0.7ms
$ echo $?
If the userspace involved is defective and hangs rather than returning an error immediately, that's another problem. The kernel can't compensate for such buggy userspace.