Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #3452 > unrolled thread

Blocking top level domains

Back to article view | Back to comp.os.linux.networking

Contents

  Blocking top level domains "James H. Markowitz" <noone@nowhere.net> - 2015-08-07 21:42 +0000
    Re: Blocking top level domains Vilmos Soti <vilmos@soti.ca> - 2015-08-07 21:02 -0700
      Re: Blocking top level domains Ian Zimmerman <itz@buug.org> - 2015-08-08 08:09 -0700
        Re: Blocking top level domains "James H. Markowitz" <noone@nowhere.net> - 2015-08-08 21:25 +0000
          Re: Blocking top level domains Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2015-08-08 23:31 +0200
          Re: Blocking top level domains William Unruh <unruh@invalid.ca> - 2015-08-09 13:51 +0000
            Re: Blocking top level domains "James H. Markowitz" <noone@nowhere.net> - 2015-08-09 15:57 +0000
              Re: Blocking top level domains William Unruh <unruh@invalid.ca> - 2015-08-09 16:38 +0000
                Re: Blocking top level domains Clark Smith <noaddress@nowhere.net> - 2015-08-09 23:30 +0000
        Re: Blocking top level domains Vilmos Soti <vilmos@soti.ca> - 2015-08-08 22:33 -0700
    Re: Blocking top level domains Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2015-08-08 10:28 +0200
      Re: Blocking top level domains Jorgen Grahn <grahn+nntp@snipabacken.se> - 2015-08-08 12:48 +0000
      Re: Blocking top level domains Lew Pitcher <lew.pitcher@digitalfreehold.ca> - 2015-08-08 10:42 -0400
        Re: Blocking top level domains Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2015-08-08 17:52 +0200
    Re: Blocking top level domains Marc Haber <mh+usenetspam1118@zugschl.us> - 2015-08-08 15:09 +0200
    Re: Blocking top level domains Joe Beanfish <joebeanfish@nospam.duh> - 2015-08-09 01:33 +0000

#3452 — Blocking top level domains

	I want to block all packets coming to my systems from IP 
addresses in a given domain - say, cn. Can this be done with iptables? If 
not, what is the tool for the job?

[toc] | [next] | [standalone]

#3453

"James H. Markowitz" <noone@nowhere.net> writes:

> 	I want to block all packets coming to my systems from
> IP addresses in a given domain - say, cn. Can this be done
> with iptables? If not, what is the tool for the job?

I am not familiar with iptables, but you can do this if you are running
your own dns server. That's what I do at home (and work). I use djbdns.

Vilmos

[toc] | [prev] | [next] | [standalone]

#3459

On 2015-08-07 21:02 -0700, Vilmos Soti wrote:

James> I want to block all packets coming to my systems from IP
James> addresses in a given domain - say, cn. Can this be done with
James> iptables? If not, what is the tool for the job?

Vilmos> I am not familiar with iptables, but you can do this if you are
Vilmos> running your own dns server. That's what I do at home (and
Vilmos> work). I use djbdns.

Really?  Have you read the question carefully?

Given the nature of DNS and how iptables work, I believe this is
impossible to do in real time.  It may be possible with some kind of
asynchronous queue setup, ie. connections are logged, some daemon picks
them up from the log, does a reverse DNS lookup, if it matches the
blacklist it adds a rule back to iptables.

James: why do you want to do this?

-- 
Please *no* private copies of mailing list or newsgroup messages.
Rule 420: All persons more than eight miles high to leave the court.

[toc] | [prev] | [next] | [standalone]

#3461

On Sat, 08 Aug 2015 08:09:34 -0700, Ian Zimmerman wrote:

> On 2015-08-07 21:02 -0700, Vilmos Soti wrote:
> 
> James> I want to block all packets coming to my systems from IP James>
> addresses in a given domain - say, cn. Can this be done with James>
> iptables? If not, what is the tool for the job?
> 
> Vilmos> I am not familiar with iptables, but you can do this if you are
> Vilmos> running your own dns server. That's what I do at home (and
> Vilmos> work). I use djbdns.
> 
> Really?  Have you read the question carefully?
> 
> Given the nature of DNS and how iptables work, I believe this is
> impossible to do in real time.  It may be possible with some kind of
> asynchronous queue setup, ie. connections are logged, some daemon picks
> them up from the log, does a reverse DNS lookup, if it matches the
> blacklist it adds a rule back to iptables.
> 
> James: why do you want to do this?

	To drop any incoming packets associated with IP addresses that 
have been allocated to a specific country.

[toc] | [prev] | [next] | [standalone]

#3462

James H. Markowitz a écrit :
>>
>> I want to block all packets coming to my systems from IP
>> addresses in a given domain - say, cn.
(...)
> 	To drop any incoming packets associated with IP addresses that 
> have been allocated to a specific country.

That's not the same. The reverse DNS name has nothing to do with the
allocation country. Check Marc Haber's reply.

[toc] | [prev] | [next] | [standalone]

#3472

On 2015-08-08, James H. Markowitz <noone@nowhere.net> wrote:
> On Sat, 08 Aug 2015 08:09:34 -0700, Ian Zimmerman wrote:
>
>> On 2015-08-07 21:02 -0700, Vilmos Soti wrote:
>> 
>> James> I want to block all packets coming to my systems from IP James>
>> addresses in a given domain - say, cn. Can this be done with James>
>> iptables? If not, what is the tool for the job?
>> 
>> Vilmos> I am not familiar with iptables, but you can do this if you are
>> Vilmos> running your own dns server. That's what I do at home (and
>> Vilmos> work). I use djbdns.
>> 
>> Really?  Have you read the question carefully?
>> 
>> Given the nature of DNS and how iptables work, I believe this is
>> impossible to do in real time.  It may be possible with some kind of
>> asynchronous queue setup, ie. connections are logged, some daemon picks
>> them up from the log, does a reverse DNS lookup, if it matches the
>> blacklist it adds a rule back to iptables.
>> 
>> James: why do you want to do this?
>
> 	To drop any incoming packets associated with IP addresses that 
> have been allocated to a specific country.

Yes, You made the clear before. Why do you want to do this, not what do
you want to do?

[toc] | [prev] | [next] | [standalone]

#3473

On Sun, 09 Aug 2015 13:51:29 +0000, William Unruh wrote:

> On 2015-08-08, James H. Markowitz <noone@nowhere.net> wrote:
>> On Sat, 08 Aug 2015 08:09:34 -0700, Ian Zimmerman wrote:
>>
>>> On 2015-08-07 21:02 -0700, Vilmos Soti wrote:
>>> 
>>> James> I want to block all packets coming to my systems from IP James>
>>> addresses in a given domain - say, cn. Can this be done with James>
>>> iptables? If not, what is the tool for the job?
>>> 
>>> Vilmos> I am not familiar with iptables, but you can do this if you
>>> are Vilmos> running your own dns server. That's what I do at home (and
>>> Vilmos> work). I use djbdns.
>>> 
>>> Really?  Have you read the question carefully?
>>> 
>>> Given the nature of DNS and how iptables work, I believe this is
>>> impossible to do in real time.  It may be possible with some kind of
>>> asynchronous queue setup, ie. connections are logged, some daemon
>>> picks them up from the log, does a reverse DNS lookup, if it matches
>>> the blacklist it adds a rule back to iptables.
>>> 
>>> James: why do you want to do this?
>>
>> 	To drop any incoming packets associated with IP addresses that
>> have been allocated to a specific country.
> 
> Yes, You made the clear before. Why do you want to do this, not what do
> you want to do?

	Well, because I do not want to see any incoming packets 
associated with IP addresses that have been allocated to specific 
countries.

[toc] | [prev] | [next] | [standalone]

#3474

On 2015-08-09, James H. Markowitz <noone@nowhere.net> wrote:
> On Sun, 09 Aug 2015 13:51:29 +0000, William Unruh wrote:
>
>> On 2015-08-08, James H. Markowitz <noone@nowhere.net> wrote:
>>> On Sat, 08 Aug 2015 08:09:34 -0700, Ian Zimmerman wrote:
>>>
>>>> On 2015-08-07 21:02 -0700, Vilmos Soti wrote:
>>>> 
>>>> James> I want to block all packets coming to my systems from IP James>
>>>> addresses in a given domain - say, cn. Can this be done with James>
>>>> iptables? If not, what is the tool for the job?
>>>> 
>>>> Vilmos> I am not familiar with iptables, but you can do this if you
>>>> are Vilmos> running your own dns server. That's what I do at home (and
>>>> Vilmos> work). I use djbdns.
>>>> 
>>>> Really?  Have you read the question carefully?
>>>> 
>>>> Given the nature of DNS and how iptables work, I believe this is
>>>> impossible to do in real time.  It may be possible with some kind of
>>>> asynchronous queue setup, ie. connections are logged, some daemon
>>>> picks them up from the log, does a reverse DNS lookup, if it matches
>>>> the blacklist it adds a rule back to iptables.
>>>> 
>>>> James: why do you want to do this?
>>>
>>> 	To drop any incoming packets associated with IP addresses that
>>> have been allocated to a specific country.
>> 
>> Yes, You made the clear before. Why do you want to do this, not what do
>> you want to do?
>
> 	Well, because I do not want to see any incoming packets 
> associated with IP addresses that have been allocated to specific 
> countries.
>

Sorry, simply restating your desire does not explain it. You are asking
for help. You are relying on others to help you and must persuade them
that they should spend their time, knowledge, and effort in helping you.
To do so you must interest them in the problem. You have now repeated
your desire three times, but persistantly refuse to say why you want to
accomplish that. 

I could say-- pull the plug on your computer. Then you will see none of
the incoming packets which have been allocated to specific countries,
(nor any other). Is that a solution? If not why not? You could set up IP
tables to reject everything but put in a caveate that you will allow
through stuff from 142.103.234.xxx (That is the UBC physics network).
Would that satisfy you? I have now made two suggestions. Since I have no
idea what reason you have for what you want, I also have no idea if
those suggestions would satify you. 

Ie, when you ask others for time and help, being as expansive as
possible about what you want, why you want it is not only good for you,
but also polite. (ie there could be very
different ways of accomplishing what you really want that the solution
you have come up with but if you do not tell us what you really want, we
will not suggest them). 

If it is simply a whim, you do not like countries whose names start with
C say, then we can ignore you and not waste our time. 

Note that if you want to stop attacks, there are ways of doing that (eg
/etc/hosts.allow and scripts which will deny IP addresses which carry
out attacks on you) which are far less costly than your solution.

I have such a script. At present the first byte of the IP addresses 
which have attacked me are

1 2 5 8 12 14 23 24 27 31 36 37 38 40 41 42 43 45 46 49 50 52 54 58
59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82
83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 103 104 106
107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124
125 129 130 131 132 133 134 138 139 140 141 142 144 145 146 148 149 150
151 152 153 155 157 159 161 162 168 171 172 173 174 175 176 177 178 179
180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 198
199 200 201 202 203 204 206 207 208 209 210 211 212 213 216 217 218 219
220 221 222 223

(ie 165 out o fthe possible 255 top levelbytes. Ie, almost everyone
tries to get into my machine.)

[toc] | [prev] | [next] | [standalone]

#3476

On Sun, 09 Aug 2015 16:38:23 +0000, William Unruh wrote:

> On 2015-08-09, James H. Markowitz <noone@nowhere.net> wrote:
>> On Sun, 09 Aug 2015 13:51:29 +0000, William Unruh wrote:
>>
>>> On 2015-08-08, James H. Markowitz <noone@nowhere.net> wrote:
>>>> On Sat, 08 Aug 2015 08:09:34 -0700, Ian Zimmerman wrote:
>>>>
>>>>> On 2015-08-07 21:02 -0700, Vilmos Soti wrote:
>>>>> 
>>>>> James> I want to block all packets coming to my systems from IP
>>>>> James>
>>>>> addresses in a given domain - say, cn. Can this be done with James>
>>>>> iptables? If not, what is the tool for the job?
>>>>> 
>>>>> Vilmos> I am not familiar with iptables, but you can do this if you
>>>>> are Vilmos> running your own dns server. That's what I do at home
>>>>> (and Vilmos> work). I use djbdns.
>>>>> 
>>>>> Really?  Have you read the question carefully?
>>>>> 
>>>>> Given the nature of DNS and how iptables work, I believe this is
>>>>> impossible to do in real time.  It may be possible with some kind of
>>>>> asynchronous queue setup, ie. connections are logged, some daemon
>>>>> picks them up from the log, does a reverse DNS lookup, if it matches
>>>>> the blacklist it adds a rule back to iptables.
>>>>> 
>>>>> James: why do you want to do this?
>>>>
>>>> 	To drop any incoming packets associated with IP addresses that
>>>> have been allocated to a specific country.
>>> 
>>> Yes, You made the clear before. Why do you want to do this, not what
>>> do you want to do?
>>
>> 	Well, because I do not want to see any incoming packets
>> associated with IP addresses that have been allocated to specific
>> countries.
>>
>>
> Sorry, simply restating your desire does not explain it. You are asking
> for help. You are relying on others to help you and must persuade them
> that they should spend their time, knowledge, and effort in helping you.
> To do so you must interest them in the problem. You have now repeated
> your desire three times, but persistantly refuse to say why you want to
> accomplish that.

	I'd be interested to learn if there is a way so that when a 
packet is received, based on the IP address in the packet, one could 
determine, in real time, what country that IP address has been allocated 
to and, on that basis, decide whether or not to drop the packet. 

[toc] | [prev] | [next] | [standalone]

#3468

Ian Zimmerman <itz@buug.org> writes:

> On 2015-08-07 21:02 -0700, Vilmos Soti wrote:
>
> James> I want to block all packets coming to my systems from IP
> James> addresses in a given domain - say, cn. Can this be done with
> James> iptables? If not, what is the tool for the job?
>
> Vilmos> I am not familiar with iptables, but you can do this if you are
> Vilmos> running your own dns server. That's what I do at home (and
> Vilmos> work). I use djbdns.
>
> Really?  Have you read the question carefully?

Grumble. You are right. :-)

What I am doing is I block specific domains such as facebook.com via
dns. So when I want to go to whatever.facebook.com, I get "host not
found". What it accomplishes is that if I go to any website which has a
facebook like/hate link with an image, my browser doesn't get that part
of the page, so facebook has a much harder time of tracking me.

Vilmos

[toc] | [prev] | [next] | [standalone]

#3455

Hello,

James H. Markowitz a écrit :
> 	I want to block all packets coming to my systems from IP 
> addresses in a given domain - say, cn. Can this be done with iptables?

No. Iptables packet filter does not understand DNS.

> If not, what is the tool for the job?

None. There is no reliable relationship between an IP address and a
domain name.

[toc] | [prev] | [next] | [standalone]

#3456

On Sat, 2015-08-08, Pascal Hambourg wrote:
> Hello,
>
> James H. Markowitz a écrit :
>> 	I want to block all packets coming to my systems from IP 
>> addresses in a given domain - say, cn. Can this be done with iptables?
>
> No. Iptables packet filter does not understand DNS.
>
>> If not, what is the tool for the job?
>
> None. There is no reliable relationship between an IP address and a
> domain name.

And for that matter, no reliable relationship between domain and "I
want to block this guy".  There are lots of nice, loveable people in
China; many are better humans than you and me.  You want to have
contact with them, not block them at the IP level.

/Jorgen

-- 
  // Jorgen Grahn <grahn@  Oo  o.   .     .
\X/     snipabacken.se>   O  o   .

[toc] | [prev] | [next] | [standalone]

#3458

On Saturday August 8 2015 04:28, in comp.os.linux.networking, "Pascal
Hambourg" <boite-a-spam@plouf.fr.eu.org> wrote:

> Hello,
> 
> James H. Markowitz a écrit :
>> I want to block all packets coming to my systems from IP
>> addresses in a given domain - say, cn. Can this be done with iptables?
> 
> No. Iptables packet filter does not understand DNS.

Sorry, but I have to differ

You /can/ write Iptables rules that specify DNS FQDN or network names.
The -s (--source) and -d (--destination) options that permit you to specify
the inspected IP packet's source IP address and destination IP address allow
for "network name" or "host name" values, along with IP addresses and IP
addresses with network mask.

The documentation notes that it is NOT a good idea to use host or network
names.

See the -s, --source and -d, --destination option descriptions of iptables(1)
for specific information.

>> If not, what is the tool for the job?
> 
> None.

Agreed.

> There is no reliable relationship between an IP address and a domain name.

Sort of disagree. There /is/ a reliable relationship between IP address and
domain name, otherwise DNS wouldn't work.

However, there isn't a unique, consistant relationship between IP address and
domain name; an IP address can belong to more than one domain (or no domain),
and a domain can have more than one IP address.

-- 
Lew Pitcher
"In Skills, We Trust"
PGP public key available upon request

[toc] | [prev] | [next] | [standalone]

#3460

Lew Pitcher a écrit :
> On Saturday August 8 2015 04:28, in comp.os.linux.networking, "Pascal
> Hambourg" <boite-a-spam@plouf.fr.eu.org> wrote:
> 
>> Iptables packet filter does not understand DNS.
> 
> Sorry, but I have to differ
> 
> You /can/ write Iptables rules that specify DNS FQDN or network names.

No, you cannot.
You can use domain/host/network names as source or destination when
creating a rule, but then the names are resolved into IP addresses at
create time and the resulting rules only contain IP addresses.

> The -s (--source) and -d (--destination) options that permit you to specify
> the inspected IP packet's source IP address and destination IP address allow
> for "network name" or "host name" values, along with IP addresses and IP
> addresses with network mask.

The iptables userland command is not the iptables kernel packet filter.

[toc] | [prev] | [next] | [standalone]

#3457

"James H. Markowitz" <noone@nowhere.net> wrote:
>	I want to block all packets coming to my systems from IP 
>addresses in a given domain - say, cn. Can this be done with iptables? If 
>not, what is the tool for the job?

You seem to have a fundamental misunderstanding about IP, DNS and
Domains. That being said, and assuming that you want to block
countries, not top level domains, you might take a look at the RIR
databases.

Greetings
Marc

P.S.: Which top level domain does 212.227.142.1 belong to? It has both
www.1und1.de and www.1und1.biz pointing to it, its reverse DNS
resolves to www.1und1.com, which in turn resolves forward to a totally
different IP address, 217.160.87.146.
-- 
-------------------------------------- !! No courtesy copies, please !! -----
Marc Haber         |   " Questions are the         | Mailadresse im Header
Mannheim, Germany  |     Beginning of Wisdom "     | http://www.zugschlus.de/
Nordisch by Nature | Lt. Worf, TNG "Rightful Heir" | Fon: *49 621 72739834

[toc] | [prev] | [next] | [standalone]

#3463

On Fri, 07 Aug 2015 21:42:31 +0000, James H. Markowitz wrote:

> I want to block all packets coming to my systems from IP addresses in a
> given domain - say, cn. Can this be done with iptables? If not, what is
> the tool for the job?

Not by DNS. But you can block coursely by region/country.
Get major block ownerships from
http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.txt

I use that list to block ssh from most non-US regions. Dramatically
reduces brute force attacks.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.os.linux.networking

csiph-web