Deny IP's from everything

[Sputnik]

Ok im tired of probes from china so what id like to know is there a way to deny connections from lets say ip addy's from my entire computer and open ports. Not just apache with .htaccess. Is there an equivilent to .htaccess? I mean its just script kiddies and i have nothing they could want. Think about it 28 hits on root threw ssh and it saying connection is refused would tell me root cant log on here. I dont know thats just me. I am allready firewalled with my router, and linux firewall and selinux. And keep nothing on my computer that i would care a script kiddie would gain from an attack. Never the less is this possible?

[Sputnik]

found my answer after probing the forums more. and using different search strings. jsut add ip and deny in the hosts file. and play with iptables. Will try to figure the second part out.

[taylor65]

if you run iptables, you can define which ports are open to the outside with System Settings -> Security Level.

[Uhlix]

you could install firestarter GUI to control iptables for you...or you could use gShield which is a script that controls iptables. Both are easy to use...and you could just add the IP to deny.

[greatscot]

I added this line to /etc/hosts.deny

ALL: ALL

And my /etc/hosts.allow only has

ALL: 127.0.0.1

But, that has the effect of denying everything from everywhere, probably not a good idea if you are running a server.

[DRE.ORGY.NET]

from what I have heard adding IP addresses to /etc/hosts.deny doesnt always work because not all applications actually conform with it. I have had the same problem with people trying to brute force my ssh server so I decided to go for iptables. Ip tables seems fairly simple to start off with but can get really complex so I would recommend using Narc (google for narc) its a script which basically you edit one configuration file and it will create all the iptables rules for you its greate if you just want to allow certain services externally but still allow local clients to access all services. Check it out (here is a link if your lazy :p http://www.knowplace.org/netfilter/narc.html)

[secuirtyguru]

Hi,
In your case i suggest you to use APF firewall script to deny any port or Ip addresses. You don't need to learn Iptables though :)
APF script just works fine for workstations to advanced servers. :)
http://www.rfxnetworks.com/apf.php

Just my two cents... :cool:

[Zigzagcom]

I haven't gone that far myself, but I think that you can also filter IP address blocks. The trick is to find the blocks that are used in Asia. Finding out what range of Ip's APNIC is responsible for might be a good starting point. Something like 61.48.0.0 or thereabouts. But on the other hand, if you want to be accessible, ie. website, what can you do other than good stateful packet filtering and only enabling the services you need, correct permissions, tight scripts, and good passwords. Also consider max. login attempts for services such as SSH,etc. Hackers give up soon, when it is more effort and time consuming. As far as IP tables are concerned, I always found it easier to have an implicit "deny all" as the last rule at the bottom and to selectively enable the services and ports, rather than allow all and then having to figure out what to deny, which can make for some very large tables. Much easier to keep track of and log as well.

[DRE.ORGY.NET]

Narc does this all for you, it will create all rules in iptables easily and quickly (if you cant be bothered creating them yourself) it will filter invalid packets as well as spoofed packets The LOT!

I was going to paste a copy of my iptables -L but it went over the 10000 character limit :p

[alphonsebrown]

in hosts.deny
add:
sshd: .cn, .cn.net, .cn.com, .jp, .jp.com #block domains from China and Japan cool huh :))
sshd: UNKNOWN
#you may comment the latter