Blocking of outgoing IP ranges

CJR · January 24, 2020

Hi Fing,

Is it possible to let FingBox deny packages addressed to IP addresses within specific IP ranges?

I'd like to be able to select IP ranges to be blocked; as an example I'd like to ensure that my IoT equipment doesn't contact Russia, Africa etc.

rooted · January 24, 2020

It's actually not complicated to block an entire country using iptables, the following site will generate a script for you in multiple formats (see screenshot for commonly used formats):

https://www.ip2location.com/free/visitor-blocker

But for a better way I suggest you read the following excellent write up:

https://mattwilcox.net/web-development/unexpected-ddos-blocking-china-with-ipset-and-iptables

This is of course overkill, I would suggest monitoring the network to find specific IP addresses and block those, you can usually do this in common routers as @Pixelpopper mentions above.

Marc · January 24, 2020

Hi @CJR , that's more of a function for your router and or firewall. Fingbox tends to specialize more on the ability to deny or allow hosts onto your network, along with looking out for certain external threats which it can identify or block.

There are probably lots of people on these forums who could direct you to software or hardware solutions for what you are looking for. @rooted
@kltaylor @Pixelpopper etc... Any thoughts here?

rooted · January 24, 2020

That's a job for iptables, few standard routers will allow this type of filtering but any router running DD-WRT, LEDE, or OpenWRT will allow you to use iptables.

[Deleted User] · January 24, 2020

Many standard, ISP supplied routers, are capable of blocking websites via the Parental Control functionality (This often includes additional customisable security options). Some ISPs spread these options between the router & web based accounts (BT use combined method for their U.K. customers) but check with your ISP for further details. Of course to block an entire nation’s websites will probably require some significant investment in time & cash. To restrict the scale of these investments you might consider monitoring which websites are being accessed from your network and then block those sites (not all Russian sites, for example, are attempting to defraud everyone).

If the last sentence is of interest then the following link may be of interest.

https://community.fing.com/discussion/comment/11670

CJR · January 28, 2020

Thanks for your answers! I agree that this might be out of scope for FingBox, although it might be fairly easy to block from there. Thanks for the DDOS link, seems that I should really dig into doing this from a router :-)

[Deleted User] · January 28, 2020

The user and all related content has been deleted.

CJR · January 28, 2020

Done; although selecting only one isn't totally fair ;-)

I'll check up on EdgeRouter X, which can do this :-)

Blocking of outgoing IP ranges

Best Answer

Answers

Categories