How to ban IP in EFW Ver2.3

[Guest]

[jackyy2k1]

How to ban IP in EFW Ver2.3? I can't find the Network Banned IP address in Ver 2.3. Is it changed to be "Access Policies"? Thanks

[whoiam55]

We need some more information.

what type of ban you want to place on the IP? I mean do you want to ban an IP from your network to access internet? or you want to block an IP on internet so that your users can't connect to it?

[gyp_the_cat]

If you want a quick and easy "ban" Jackyy, try the following from the command line

iptables -A INPUT -s <IP Address here> -j DROP

But more information would be better as to what you're trying to achieve

[blckz28]

Well I might have the same question.  We used to have IPCop and had an add-on called Banish.  It allowed us to block public IP addresses from accessing our network at the firewall level.  We mainly used it when somebody would try a brute force attack on our ftp sites.  All I had to do was enter the IP address the attack was coming from and the firewall would block them.  Is there any way to achieve this in Endian?

-also note I'm not a Linux guru, is the iptables command the way to go?  Would there be a way to do it with a firewall rule?

Thanks

[vlongjvc]

Just want to share my experience, you can drop multiple IP addresses by creating a Destination NAT rule:

- Access from:
x.x.x.x/32
x.x.x.x/32
.....
x.x.x.x/32

- Target:
<ANY Uplink>

- Filter policy:
DROP

- Service:
<ANY>
- Protocol:
<ANY>

[blckz28]

Just want to share my experience, you can drop multiple IP addresses by creating a Destination NAT rule:

- Access from:
x.x.x.x/32
x.x.x.x/32
.....
x.x.x.x/32

- Target:
<ANY Uplink>

- Filter policy:
DROP

- Service:
<ANY>
- Protocol:
<ANY>

Thanks vlongjvc, I'll give it a try.

[jackyy2k1]

It's not working... any other alternative to banned IP address in EFW 2.3? I have no problem with V2.2 but not 2.3. Thanks.

[AussieBloke]

You can make a general IP ban list. You need to go to Port forwarding / Destination NAT

1. create a new rule
2. Click on the advanced mode
3. Incoming IP: Type: Zone/VPN/Upllink. Select Uplink main - IP:All known.
3. Incoming service port, Service: Any, Port: Any.
4. In the Translate To section set Type: IP, Insert IP: leave blank, NAT: NAT

Access From Section.
Source Type: Network/IP/Range
Filter Policy: Drop
In the Network UP's box, enter a single IPor IP CIDR. eg 61.144.2.10 or 61.144.0.0/14

Check the enabled box. In the comment section type Blocked Incoming IP's

Make the position first.
It is important the rule is the first one, else the precending rules will overide the block.

If you a list of country and/or IP CIR go to www countryipblocks net

[Nick57]

Thanks very much, I was wondering how to give some comments on each row of blocked IP range, I am used of CSF there it is possible to do as follow;

222.0.0.0/8  # China - do not delete

# China - hacking website of customer!

* the - do not delete refers to when flushing everything still keep this rule.

[bozzen]

Thanks ..

If you want to block certain countries like China ( who's trying to brute force all services all the time !! ) then this site is usefull to find all ip ranges

URL : www . countryipblocks . net / country_selection.php