# Blocked IP not blocking **URL:** \ **Category:** Firewall Rules\ **Created:** [4 October 2022 14:33 UTC](https://community.ipfire.org/t/blocked-ip-not-blocking/8712 "2022-10-04T14:33:46Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![matthaesius](https://community.ipfire.org/user_avatar/community.ipfire.org/matthaesius/32/8382_2.png) [@matthaesius](https://community.ipfire.org/u/matthaesius)\ **Post date:** [4 October 2022 14:33 UTC](https://community.ipfire.org/t/blocked-ip-not-blocking/8712/1 "2022-10-04T14:33:46Z")
Hello, I have created a simple rule, to block a device from accessing the internet. Only NTP shall be allowed. As DNS only Ipfire’s inbuilt DNS server is allowed. ![grafik](https://community.ipfire.org/uploads/default/original/2X/6/6050f0afdc711d47f836c476b789577a8ced7d0f.png) Now, the way I understand the logs is, that this IP `192.168.77.230` does **not** get blocked: ![grafik](https://community.ipfire.org/uploads/default/original/2X/8/811f4dc4993846da40f66670b7a5c10c6d3b975a.png) First I thought it’s a long session that would just continue, but I can’t see anything with `conntrack -L -s 192.168.77.230` Do I still have a knot in my brain, or is really something not working? Regards ---
**Author:** ![bbitsch](https://community.ipfire.org/user_avatar/community.ipfire.org/bbitsch/32/7420_2.png) [@bbitsch](https://community.ipfire.org/u/bbitsch)\ **Post date:** [4 October 2022 14:46 UTC](https://community.ipfire.org/t/blocked-ip-not-blocking/8712/2 "2022-10-04T14:46:31Z")
Usually the logs show the blocked accesses. So your rules should be working. You can check that, if you look at the iptables rules in Firewall → iptables, section FORWARDFW. ---
**Author:** ![matthaesius](https://community.ipfire.org/user_avatar/community.ipfire.org/matthaesius/32/8382_2.png) [@matthaesius](https://community.ipfire.org/u/matthaesius)\ **Post date:** [4 October 2022 22:06 UTC](https://community.ipfire.org/t/blocked-ip-not-blocking/8712/3 "2022-10-04T22:06:46Z")
Oh, I see… but it rather seems to me, everything’s logged that hits a rule, i. e. ```auto [user@host:~]$ date +%T ; telnet 193.99.144.80 443 23:24:15 Trying 193.99.144.80... Connected to 193.99.144.80. Escape character is '^]'. ^] telnet> quit Connection closed. [user@host:~]$ date +%T ; telnet 8.8.4.4 443 23:24:24 Trying 8.8.4.4... ^C ``` ![grafik](https://community.ipfire.org/uploads/default/original/2X/2/23285983a7d091b9e11a053f9b457f24482fe80d.png) (I do block the Google DNS servers…) Do I see interpret that right? If so, is there any way to distinguish between blocked and allowed traffic? Regards ---
**Author:** ![hvacguy](https://community.ipfire.org/user_avatar/community.ipfire.org/hvacguy/32/8576_2.png) [@hvacguy](https://community.ipfire.org/u/hvacguy)\ **Post date:** [5 October 2022 00:33 UTC](https://community.ipfire.org/t/blocked-ip-not-blocking/8712/4 "2022-10-05T00:33:47Z")
Have you seen this? I do this for DNS and NTP. Works great. > **[Force clients to use IPFire DNS Server - The IPFire Wiki](https://wiki.ipfire.org/configuration/firewall/dns)** ---
**Author:** ![bbitsch](https://community.ipfire.org/user_avatar/community.ipfire.org/bbitsch/32/7420_2.png) [@bbitsch](https://community.ipfire.org/u/bbitsch)\ **Post date:** [5 October 2022 08:00 UTC](https://community.ipfire.org/t/blocked-ip-not-blocking/8712/5 "2022-10-05T08:00:39Z")
@matthaesius , that’s right! If you tick the ‘Log’ check box for blocking rules only, only those are logged. Your rules 1 and 3 are allow rules, for example. ---
**Author:** ![matthaesius](https://community.ipfire.org/user_avatar/community.ipfire.org/matthaesius/32/8382_2.png) [@matthaesius](https://community.ipfire.org/u/matthaesius)\ **Post date:** [5 October 2022 08:39 UTC](https://community.ipfire.org/t/blocked-ip-not-blocking/8712/6 "2022-10-05T08:39:05Z")
Cool, didn’t know that one 😀 ---
**Author:** ![matthaesius](https://community.ipfire.org/user_avatar/community.ipfire.org/matthaesius/32/8382_2.png) [@matthaesius](https://community.ipfire.org/u/matthaesius)\ **Post date:** [6 October 2022 05:42 UTC](https://community.ipfire.org/t/blocked-ip-not-blocking/8712/7 "2022-10-06T05:42:40Z")
Ok, got it. 🙂 Now one (final) question, when would a message like that show up? (the `REJECT_FORWARD` ones) ![grafik](https://community.ipfire.org/uploads/default/original/2X/d/dced53d4dc4eabcd92a696d86605184d0d1e4db3.png) (That’s Google by the way 🤨) ---
**Author:** ![bbitsch](https://community.ipfire.org/user_avatar/community.ipfire.org/bbitsch/32/7420_2.png) [@bbitsch](https://community.ipfire.org/u/bbitsch)\ **Post date:** [13 October 2022 08:41 UTC](https://community.ipfire.org/t/blocked-ip-not-blocking/8712/8 "2022-10-13T08:41:58Z")
@matthaesius Sorry for the late reply. You can list your iptables rules with `getipstat` with parameters - `-f` … table filter - `-m` … table mangle - `-n` … table nat from a shell. This should show the rule which generates the `REJECT_FORWARD` label.