How to filter ranges of IP addresses?

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP











up vote
0
down vote

favorite












How could I filter a single IP address or a range of IP addresses to prevent them from accessing my computer?



Examples:



  1. Block 31.13.76.102


  2. Block from 216.58.192.0 to 216.58.223.255


  3. Block from 173.194.0.0 to 173.194.255.255


  4. Block from 74.125.136.0 to 74.125.136.255


I would like to block them from accessing my computer without additionnal conditions.



I know that one can use iptables in this situation, but I am unaware of the exact syntax, how to make the changes permanent, and which command to run in order to launch the iptables service at startup. I also don't want to make mistakes that may break my access to the Internet.







share|improve this question






















  • OK for filtering rules. Thank you for all the repliers. Now does someone know which addresses range to target for getting rid of advertisements on spotifi free accounts ? Thank you everyone.
    – Thierry
    Mar 6 at 0:33














up vote
0
down vote

favorite












How could I filter a single IP address or a range of IP addresses to prevent them from accessing my computer?



Examples:



  1. Block 31.13.76.102


  2. Block from 216.58.192.0 to 216.58.223.255


  3. Block from 173.194.0.0 to 173.194.255.255


  4. Block from 74.125.136.0 to 74.125.136.255


I would like to block them from accessing my computer without additionnal conditions.



I know that one can use iptables in this situation, but I am unaware of the exact syntax, how to make the changes permanent, and which command to run in order to launch the iptables service at startup. I also don't want to make mistakes that may break my access to the Internet.







share|improve this question






















  • OK for filtering rules. Thank you for all the repliers. Now does someone know which addresses range to target for getting rid of advertisements on spotifi free accounts ? Thank you everyone.
    – Thierry
    Mar 6 at 0:33












up vote
0
down vote

favorite









up vote
0
down vote

favorite











How could I filter a single IP address or a range of IP addresses to prevent them from accessing my computer?



Examples:



  1. Block 31.13.76.102


  2. Block from 216.58.192.0 to 216.58.223.255


  3. Block from 173.194.0.0 to 173.194.255.255


  4. Block from 74.125.136.0 to 74.125.136.255


I would like to block them from accessing my computer without additionnal conditions.



I know that one can use iptables in this situation, but I am unaware of the exact syntax, how to make the changes permanent, and which command to run in order to launch the iptables service at startup. I also don't want to make mistakes that may break my access to the Internet.







share|improve this question














How could I filter a single IP address or a range of IP addresses to prevent them from accessing my computer?



Examples:



  1. Block 31.13.76.102


  2. Block from 216.58.192.0 to 216.58.223.255


  3. Block from 173.194.0.0 to 173.194.255.255


  4. Block from 74.125.136.0 to 74.125.136.255


I would like to block them from accessing my computer without additionnal conditions.



I know that one can use iptables in this situation, but I am unaware of the exact syntax, how to make the changes permanent, and which command to run in order to launch the iptables service at startup. I also don't want to make mistakes that may break my access to the Internet.









share|improve this question













share|improve this question




share|improve this question








edited Mar 5 at 18:36









aliceinpalth

760116




760116










asked Mar 5 at 17:50









Thierry

11




11











  • OK for filtering rules. Thank you for all the repliers. Now does someone know which addresses range to target for getting rid of advertisements on spotifi free accounts ? Thank you everyone.
    – Thierry
    Mar 6 at 0:33
















  • OK for filtering rules. Thank you for all the repliers. Now does someone know which addresses range to target for getting rid of advertisements on spotifi free accounts ? Thank you everyone.
    – Thierry
    Mar 6 at 0:33















OK for filtering rules. Thank you for all the repliers. Now does someone know which addresses range to target for getting rid of advertisements on spotifi free accounts ? Thank you everyone.
– Thierry
Mar 6 at 0:33




OK for filtering rules. Thank you for all the repliers. Now does someone know which addresses range to target for getting rid of advertisements on spotifi free accounts ? Thank you everyone.
– Thierry
Mar 6 at 0:33










3 Answers
3






active

oldest

votes

















up vote
3
down vote













While you could use /etc/hosts.deny, hosts.deny only works with TCP wrapped applications such as ssh or xinetd. I would recommend using iptablessince it is a true firewall to your system. Just use something like this:



iptables -I INPUT -s 31.13.76.102 -j DROP
iptables -I INPUT -m iprange --src-range 216.58.192.0-216.58.223.255 -j DROP
iptables -I INPUT -m iprange --src-range 173.194.0.0-173.194.255.255 -j DROP
iptables -I INPUT -m iprange --src-range 74.125.136.0-74.125.136.255 -j DROP
iptables-save > /etc/sysconfig/iptables


The iprange is a really cool module to use for situations such as this.






share|improve this answer






















  • Thank you for your answer Jaken551. Three more questions please : #0 Should I start Iptables on my system before typing the filtering rules, if yes how ? #1 What is the command to start iptables at each boot (I run Majaro, an Arch-Linux based distribution whose init system is systemd) ? #2 There is no /etc/sysconfig directory on my defaukt configuration, which command do I have to type to make the filtration rules permanent ?
    – Thierry
    Mar 5 at 19:41










  • #0: You can edit the iptables rules whether or not the service is running, starting it is up to you. #1: Run systemctl enable iptables in order to have iptables service start at boot. #2: For Arch-Linux the iptables config file is /etc/iptables/iptables.rules. Unfortunately, this is not created by default with Arch, but running the iptables-save /etc/iptables/iptables.rules will create it for you :) Best of luck to you!
    – Jaken551
    Mar 5 at 21:30










  • Thank you for your answer Jaken551. It does filter the targets BUT ranges seem far too large and block part of interesting targets wheraes I only want to target advertisements...
    – Thierry
    Mar 6 at 0:27











  • What exactly are you trying to block? This is only blocking incoming connections. If you are trying to block advertisements, firewall rules are not really what you want.
    – Jaken551
    Mar 6 at 7:11










  • Yes, I want to block spotifi ad-server to get rid of commercials on the free account through the spotify application.. The problem is finding a reliable list of addresses to block. I found the mentionned-above one on reddit, but its seems to be far too obstructing. Searching with 'spotify' ad-servers' list' on Internet didnt return anything up-to-date and reliable so far for me. If you have any info, you are welcome. Some are mentionned on github but its not perfect... Maybe its possible to find it using tools like wireshark but I dont know enough to use it properly. Thank you again.
    – Thierry
    Mar 6 at 7:34

















up vote
0
down vote













Simply add the following to /etc/hosts.deny:



ALL: 31.13.76.102
ALL: 216.58.192.0/19
ALL: 173.194.0.0/16
ALL: 74.125.136.0/24





share|improve this answer





























    up vote
    0
    down vote













    The ufw command (Uncomplicated FireWall, a simplified front-end for iptables, initially for Ubuntu, now also available for Debian and other distros) accepts CIDR range specifications, for instance:



    ufw insert 1 deny from 31.13.76.102 # single address
    ufw insert 1 deny from 216.58.192.0/18 # range





    share|improve this answer




















      Your Answer







      StackExchange.ready(function()
      var channelOptions =
      tags: "".split(" "),
      id: "106"
      ;
      initTagRenderer("".split(" "), "".split(" "), channelOptions);

      StackExchange.using("externalEditor", function()
      // Have to fire editor after snippets, if snippets enabled
      if (StackExchange.settings.snippets.snippetsEnabled)
      StackExchange.using("snippets", function()
      createEditor();
      );

      else
      createEditor();

      );

      function createEditor()
      StackExchange.prepareEditor(
      heartbeatType: 'answer',
      convertImagesToLinks: false,
      noModals: false,
      showLowRepImageUploadWarning: true,
      reputationToPostImages: null,
      bindNavPrevention: true,
      postfix: "",
      onDemand: true,
      discardSelector: ".discard-answer"
      ,immediatelyShowMarkdownHelp:true
      );



      );








       

      draft saved


      draft discarded


















      StackExchange.ready(
      function ()
      StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f428332%2fhow-to-filter-ranges-of-ip-addresses%23new-answer', 'question_page');

      );

      Post as a guest






























      3 Answers
      3






      active

      oldest

      votes








      3 Answers
      3






      active

      oldest

      votes









      active

      oldest

      votes






      active

      oldest

      votes








      up vote
      3
      down vote













      While you could use /etc/hosts.deny, hosts.deny only works with TCP wrapped applications such as ssh or xinetd. I would recommend using iptablessince it is a true firewall to your system. Just use something like this:



      iptables -I INPUT -s 31.13.76.102 -j DROP
      iptables -I INPUT -m iprange --src-range 216.58.192.0-216.58.223.255 -j DROP
      iptables -I INPUT -m iprange --src-range 173.194.0.0-173.194.255.255 -j DROP
      iptables -I INPUT -m iprange --src-range 74.125.136.0-74.125.136.255 -j DROP
      iptables-save > /etc/sysconfig/iptables


      The iprange is a really cool module to use for situations such as this.






      share|improve this answer






















      • Thank you for your answer Jaken551. Three more questions please : #0 Should I start Iptables on my system before typing the filtering rules, if yes how ? #1 What is the command to start iptables at each boot (I run Majaro, an Arch-Linux based distribution whose init system is systemd) ? #2 There is no /etc/sysconfig directory on my defaukt configuration, which command do I have to type to make the filtration rules permanent ?
        – Thierry
        Mar 5 at 19:41










      • #0: You can edit the iptables rules whether or not the service is running, starting it is up to you. #1: Run systemctl enable iptables in order to have iptables service start at boot. #2: For Arch-Linux the iptables config file is /etc/iptables/iptables.rules. Unfortunately, this is not created by default with Arch, but running the iptables-save /etc/iptables/iptables.rules will create it for you :) Best of luck to you!
        – Jaken551
        Mar 5 at 21:30










      • Thank you for your answer Jaken551. It does filter the targets BUT ranges seem far too large and block part of interesting targets wheraes I only want to target advertisements...
        – Thierry
        Mar 6 at 0:27











      • What exactly are you trying to block? This is only blocking incoming connections. If you are trying to block advertisements, firewall rules are not really what you want.
        – Jaken551
        Mar 6 at 7:11










      • Yes, I want to block spotifi ad-server to get rid of commercials on the free account through the spotify application.. The problem is finding a reliable list of addresses to block. I found the mentionned-above one on reddit, but its seems to be far too obstructing. Searching with 'spotify' ad-servers' list' on Internet didnt return anything up-to-date and reliable so far for me. If you have any info, you are welcome. Some are mentionned on github but its not perfect... Maybe its possible to find it using tools like wireshark but I dont know enough to use it properly. Thank you again.
        – Thierry
        Mar 6 at 7:34














      up vote
      3
      down vote













      While you could use /etc/hosts.deny, hosts.deny only works with TCP wrapped applications such as ssh or xinetd. I would recommend using iptablessince it is a true firewall to your system. Just use something like this:



      iptables -I INPUT -s 31.13.76.102 -j DROP
      iptables -I INPUT -m iprange --src-range 216.58.192.0-216.58.223.255 -j DROP
      iptables -I INPUT -m iprange --src-range 173.194.0.0-173.194.255.255 -j DROP
      iptables -I INPUT -m iprange --src-range 74.125.136.0-74.125.136.255 -j DROP
      iptables-save > /etc/sysconfig/iptables


      The iprange is a really cool module to use for situations such as this.






      share|improve this answer






















      • Thank you for your answer Jaken551. Three more questions please : #0 Should I start Iptables on my system before typing the filtering rules, if yes how ? #1 What is the command to start iptables at each boot (I run Majaro, an Arch-Linux based distribution whose init system is systemd) ? #2 There is no /etc/sysconfig directory on my defaukt configuration, which command do I have to type to make the filtration rules permanent ?
        – Thierry
        Mar 5 at 19:41










      • #0: You can edit the iptables rules whether or not the service is running, starting it is up to you. #1: Run systemctl enable iptables in order to have iptables service start at boot. #2: For Arch-Linux the iptables config file is /etc/iptables/iptables.rules. Unfortunately, this is not created by default with Arch, but running the iptables-save /etc/iptables/iptables.rules will create it for you :) Best of luck to you!
        – Jaken551
        Mar 5 at 21:30










      • Thank you for your answer Jaken551. It does filter the targets BUT ranges seem far too large and block part of interesting targets wheraes I only want to target advertisements...
        – Thierry
        Mar 6 at 0:27











      • What exactly are you trying to block? This is only blocking incoming connections. If you are trying to block advertisements, firewall rules are not really what you want.
        – Jaken551
        Mar 6 at 7:11










      • Yes, I want to block spotifi ad-server to get rid of commercials on the free account through the spotify application.. The problem is finding a reliable list of addresses to block. I found the mentionned-above one on reddit, but its seems to be far too obstructing. Searching with 'spotify' ad-servers' list' on Internet didnt return anything up-to-date and reliable so far for me. If you have any info, you are welcome. Some are mentionned on github but its not perfect... Maybe its possible to find it using tools like wireshark but I dont know enough to use it properly. Thank you again.
        – Thierry
        Mar 6 at 7:34












      up vote
      3
      down vote










      up vote
      3
      down vote









      While you could use /etc/hosts.deny, hosts.deny only works with TCP wrapped applications such as ssh or xinetd. I would recommend using iptablessince it is a true firewall to your system. Just use something like this:



      iptables -I INPUT -s 31.13.76.102 -j DROP
      iptables -I INPUT -m iprange --src-range 216.58.192.0-216.58.223.255 -j DROP
      iptables -I INPUT -m iprange --src-range 173.194.0.0-173.194.255.255 -j DROP
      iptables -I INPUT -m iprange --src-range 74.125.136.0-74.125.136.255 -j DROP
      iptables-save > /etc/sysconfig/iptables


      The iprange is a really cool module to use for situations such as this.






      share|improve this answer














      While you could use /etc/hosts.deny, hosts.deny only works with TCP wrapped applications such as ssh or xinetd. I would recommend using iptablessince it is a true firewall to your system. Just use something like this:



      iptables -I INPUT -s 31.13.76.102 -j DROP
      iptables -I INPUT -m iprange --src-range 216.58.192.0-216.58.223.255 -j DROP
      iptables -I INPUT -m iprange --src-range 173.194.0.0-173.194.255.255 -j DROP
      iptables -I INPUT -m iprange --src-range 74.125.136.0-74.125.136.255 -j DROP
      iptables-save > /etc/sysconfig/iptables


      The iprange is a really cool module to use for situations such as this.







      share|improve this answer














      share|improve this answer



      share|improve this answer








      edited Mar 5 at 20:24









      Drakonoved

      674518




      674518










      answered Mar 5 at 18:24









      Jaken551

      1678




      1678











      • Thank you for your answer Jaken551. Three more questions please : #0 Should I start Iptables on my system before typing the filtering rules, if yes how ? #1 What is the command to start iptables at each boot (I run Majaro, an Arch-Linux based distribution whose init system is systemd) ? #2 There is no /etc/sysconfig directory on my defaukt configuration, which command do I have to type to make the filtration rules permanent ?
        – Thierry
        Mar 5 at 19:41










      • #0: You can edit the iptables rules whether or not the service is running, starting it is up to you. #1: Run systemctl enable iptables in order to have iptables service start at boot. #2: For Arch-Linux the iptables config file is /etc/iptables/iptables.rules. Unfortunately, this is not created by default with Arch, but running the iptables-save /etc/iptables/iptables.rules will create it for you :) Best of luck to you!
        – Jaken551
        Mar 5 at 21:30










      • Thank you for your answer Jaken551. It does filter the targets BUT ranges seem far too large and block part of interesting targets wheraes I only want to target advertisements...
        – Thierry
        Mar 6 at 0:27











      • What exactly are you trying to block? This is only blocking incoming connections. If you are trying to block advertisements, firewall rules are not really what you want.
        – Jaken551
        Mar 6 at 7:11










      • Yes, I want to block spotifi ad-server to get rid of commercials on the free account through the spotify application.. The problem is finding a reliable list of addresses to block. I found the mentionned-above one on reddit, but its seems to be far too obstructing. Searching with 'spotify' ad-servers' list' on Internet didnt return anything up-to-date and reliable so far for me. If you have any info, you are welcome. Some are mentionned on github but its not perfect... Maybe its possible to find it using tools like wireshark but I dont know enough to use it properly. Thank you again.
        – Thierry
        Mar 6 at 7:34
















      • Thank you for your answer Jaken551. Three more questions please : #0 Should I start Iptables on my system before typing the filtering rules, if yes how ? #1 What is the command to start iptables at each boot (I run Majaro, an Arch-Linux based distribution whose init system is systemd) ? #2 There is no /etc/sysconfig directory on my defaukt configuration, which command do I have to type to make the filtration rules permanent ?
        – Thierry
        Mar 5 at 19:41










      • #0: You can edit the iptables rules whether or not the service is running, starting it is up to you. #1: Run systemctl enable iptables in order to have iptables service start at boot. #2: For Arch-Linux the iptables config file is /etc/iptables/iptables.rules. Unfortunately, this is not created by default with Arch, but running the iptables-save /etc/iptables/iptables.rules will create it for you :) Best of luck to you!
        – Jaken551
        Mar 5 at 21:30










      • Thank you for your answer Jaken551. It does filter the targets BUT ranges seem far too large and block part of interesting targets wheraes I only want to target advertisements...
        – Thierry
        Mar 6 at 0:27











      • What exactly are you trying to block? This is only blocking incoming connections. If you are trying to block advertisements, firewall rules are not really what you want.
        – Jaken551
        Mar 6 at 7:11










      • Yes, I want to block spotifi ad-server to get rid of commercials on the free account through the spotify application.. The problem is finding a reliable list of addresses to block. I found the mentionned-above one on reddit, but its seems to be far too obstructing. Searching with 'spotify' ad-servers' list' on Internet didnt return anything up-to-date and reliable so far for me. If you have any info, you are welcome. Some are mentionned on github but its not perfect... Maybe its possible to find it using tools like wireshark but I dont know enough to use it properly. Thank you again.
        – Thierry
        Mar 6 at 7:34















      Thank you for your answer Jaken551. Three more questions please : #0 Should I start Iptables on my system before typing the filtering rules, if yes how ? #1 What is the command to start iptables at each boot (I run Majaro, an Arch-Linux based distribution whose init system is systemd) ? #2 There is no /etc/sysconfig directory on my defaukt configuration, which command do I have to type to make the filtration rules permanent ?
      – Thierry
      Mar 5 at 19:41




      Thank you for your answer Jaken551. Three more questions please : #0 Should I start Iptables on my system before typing the filtering rules, if yes how ? #1 What is the command to start iptables at each boot (I run Majaro, an Arch-Linux based distribution whose init system is systemd) ? #2 There is no /etc/sysconfig directory on my defaukt configuration, which command do I have to type to make the filtration rules permanent ?
      – Thierry
      Mar 5 at 19:41












      #0: You can edit the iptables rules whether or not the service is running, starting it is up to you. #1: Run systemctl enable iptables in order to have iptables service start at boot. #2: For Arch-Linux the iptables config file is /etc/iptables/iptables.rules. Unfortunately, this is not created by default with Arch, but running the iptables-save /etc/iptables/iptables.rules will create it for you :) Best of luck to you!
      – Jaken551
      Mar 5 at 21:30




      #0: You can edit the iptables rules whether or not the service is running, starting it is up to you. #1: Run systemctl enable iptables in order to have iptables service start at boot. #2: For Arch-Linux the iptables config file is /etc/iptables/iptables.rules. Unfortunately, this is not created by default with Arch, but running the iptables-save /etc/iptables/iptables.rules will create it for you :) Best of luck to you!
      – Jaken551
      Mar 5 at 21:30












      Thank you for your answer Jaken551. It does filter the targets BUT ranges seem far too large and block part of interesting targets wheraes I only want to target advertisements...
      – Thierry
      Mar 6 at 0:27





      Thank you for your answer Jaken551. It does filter the targets BUT ranges seem far too large and block part of interesting targets wheraes I only want to target advertisements...
      – Thierry
      Mar 6 at 0:27













      What exactly are you trying to block? This is only blocking incoming connections. If you are trying to block advertisements, firewall rules are not really what you want.
      – Jaken551
      Mar 6 at 7:11




      What exactly are you trying to block? This is only blocking incoming connections. If you are trying to block advertisements, firewall rules are not really what you want.
      – Jaken551
      Mar 6 at 7:11












      Yes, I want to block spotifi ad-server to get rid of commercials on the free account through the spotify application.. The problem is finding a reliable list of addresses to block. I found the mentionned-above one on reddit, but its seems to be far too obstructing. Searching with 'spotify' ad-servers' list' on Internet didnt return anything up-to-date and reliable so far for me. If you have any info, you are welcome. Some are mentionned on github but its not perfect... Maybe its possible to find it using tools like wireshark but I dont know enough to use it properly. Thank you again.
      – Thierry
      Mar 6 at 7:34




      Yes, I want to block spotifi ad-server to get rid of commercials on the free account through the spotify application.. The problem is finding a reliable list of addresses to block. I found the mentionned-above one on reddit, but its seems to be far too obstructing. Searching with 'spotify' ad-servers' list' on Internet didnt return anything up-to-date and reliable so far for me. If you have any info, you are welcome. Some are mentionned on github but its not perfect... Maybe its possible to find it using tools like wireshark but I dont know enough to use it properly. Thank you again.
      – Thierry
      Mar 6 at 7:34












      up vote
      0
      down vote













      Simply add the following to /etc/hosts.deny:



      ALL: 31.13.76.102
      ALL: 216.58.192.0/19
      ALL: 173.194.0.0/16
      ALL: 74.125.136.0/24





      share|improve this answer


























        up vote
        0
        down vote













        Simply add the following to /etc/hosts.deny:



        ALL: 31.13.76.102
        ALL: 216.58.192.0/19
        ALL: 173.194.0.0/16
        ALL: 74.125.136.0/24





        share|improve this answer
























          up vote
          0
          down vote










          up vote
          0
          down vote









          Simply add the following to /etc/hosts.deny:



          ALL: 31.13.76.102
          ALL: 216.58.192.0/19
          ALL: 173.194.0.0/16
          ALL: 74.125.136.0/24





          share|improve this answer














          Simply add the following to /etc/hosts.deny:



          ALL: 31.13.76.102
          ALL: 216.58.192.0/19
          ALL: 173.194.0.0/16
          ALL: 74.125.136.0/24






          share|improve this answer














          share|improve this answer



          share|improve this answer








          edited Mar 5 at 18:45

























          answered Mar 5 at 18:03









          DopeGhoti

          40.2k54779




          40.2k54779




















              up vote
              0
              down vote













              The ufw command (Uncomplicated FireWall, a simplified front-end for iptables, initially for Ubuntu, now also available for Debian and other distros) accepts CIDR range specifications, for instance:



              ufw insert 1 deny from 31.13.76.102 # single address
              ufw insert 1 deny from 216.58.192.0/18 # range





              share|improve this answer
























                up vote
                0
                down vote













                The ufw command (Uncomplicated FireWall, a simplified front-end for iptables, initially for Ubuntu, now also available for Debian and other distros) accepts CIDR range specifications, for instance:



                ufw insert 1 deny from 31.13.76.102 # single address
                ufw insert 1 deny from 216.58.192.0/18 # range





                share|improve this answer






















                  up vote
                  0
                  down vote










                  up vote
                  0
                  down vote









                  The ufw command (Uncomplicated FireWall, a simplified front-end for iptables, initially for Ubuntu, now also available for Debian and other distros) accepts CIDR range specifications, for instance:



                  ufw insert 1 deny from 31.13.76.102 # single address
                  ufw insert 1 deny from 216.58.192.0/18 # range





                  share|improve this answer












                  The ufw command (Uncomplicated FireWall, a simplified front-end for iptables, initially for Ubuntu, now also available for Debian and other distros) accepts CIDR range specifications, for instance:



                  ufw insert 1 deny from 31.13.76.102 # single address
                  ufw insert 1 deny from 216.58.192.0/18 # range






                  share|improve this answer












                  share|improve this answer



                  share|improve this answer










                  answered Mar 5 at 21:05









                  xenoid

                  1,6751620




                  1,6751620






















                       

                      draft saved


                      draft discarded


























                       


                      draft saved


                      draft discarded














                      StackExchange.ready(
                      function ()
                      StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f428332%2fhow-to-filter-ranges-of-ip-addresses%23new-answer', 'question_page');

                      );

                      Post as a guest













































































                      Popular posts from this blog

                      How to check contact read email or not when send email to Individual?

                      Bahrain

                      Postfix configuration issue with fips on centos 7; mailgun relay