I have a router running Linux. Its network configuration has a default route to my ISP for public Internet access. I now need to prevent a specified destination network from access.

Original route table:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         UG    0      0        0 eth0.2       *        U     0      0        0 tap0

Assuming is the network which I want to forbid routing. I hope every client connected to this router gets 'Network unreachable' for an address in that network.

Is there anyway to do this?


Use iproute2.

ip route add unreachable

In this case, if you're trying to deny outbound traffic to that network, it's better to use routing to deny that network, rather than netfilter. For inbound, it's more idiomatic to use netfilter, as in another answer here, but with --src instead of --dst, and had better use ICMP admin prohibited, or just drop instead. You can use the RPDB (see ip-rule(8), to achieve the same effect but likely will look out of place.

Don't use ifconfig, route, or other tools from the net-tools package; they're long deprecated.

You can confirm what the router itself will use as the routing decision.

$ ip route get
RTNETLINK answers: Network is unreachable

Note that the 'get' verb is not the same as 'show' (or 'list'), as it 'calculates' the routing decision rather than just filtering and listing entries in the routing table.

Hosts on your side of the network will get ICMP destination net unreachable.

$ ping -c 1
PING ( 56(84) bytes of data.
From icmp_seq=1 Destination Net Unreachable

--- ping statistics ---
1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0.7ms
$ echo $?

If the userspace involved is defective and hangs rather than returning an error immediately, that's another problem. The kernel can't compensate for such buggy userspace.

| improve this answer | |

You can use netfilter

iptables -A FORWARD --dst -j REJECT --reject-with icmp-net-unreachable

man iptables says the following about the --reject-with option

--reject-with type
     The type given can be icmp-net-unreachable, icmp-host-unreachable,
     icmp-port-unreachable,  icmp-proto-unreachable,  icmp-net-prohibited,
     icmp-host-prohibited  or  icmp-admin-prohibited  (*)  which  return  the
     appropriate  ICMP  error  message (port-unreachable is the default).  The
     option tcp-reset can be used on rules which only match the TCP protocol:
     this causes a TCP RST packet to be sent back.  This is mainly useful for
     blocking ident (113/tcp) probes which frequently occur when sending mail to
     broken mail hosts (which won't accept your mail otherwise)
| improve this answer | |

Add a route pointing to lo for that subnet:

route add -net gw lo

The ip command has a blackhole parameter I just found out about:

ip route add blackhole

Read more.

Looks like there's a reject option - see if that does what you need:

route add -net reject

| improve this answer | |
  • 1
    A blackhole route will silently drop the packets sent to destination network instead return 'destination network unreachable' :-( – Lingfeng Xiong Aug 5 '13 at 15:04
  • See above edits. – LawrenceC Aug 5 '13 at 15:39
  • Yes, looks like it..! – user7429642 Aug 5 '13 at 15:45
  • @ultrasawblade I tried that command and it seems the clients just reports 'timed out' instead the expected 'network unreachable' :-( – Lingfeng Xiong Aug 5 '13 at 16:45

REJECT = knock at the door , you holler go away!.

DROP = knock at the door , you sit quietly and the visitor leaves , :theory?..:P

depends on what your trying to achieve , my opinion is

REJECT says to someone to try and further the conversation till ACCEPT is achieved DROP says nothing , there for rendering any more conversation CLOSED ,:up2you:).

| improve this answer | |
  • 1
    This does not appear to answer the question. – Blackwood Sep 11 '18 at 3:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.