# Blocking an IP Address via Console Command

**URL:** <https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977>\
**Category:** Intrusion Prevention\
**Created:** [19 August 2024 17:36 UTC](https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977 "2024-08-19T17:36:31Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![user-ip](https://community.ipfire.org/user_avatar/community.ipfire.org/user-ip/32/10923_2.png) [@user-ip](https://community.ipfire.org/u/user-ip)\
**Post date:** [19 August 2024 17:36 UTC](https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977/1 "2024-08-19T17:36:31Z")

</div>

Hi everyone,

I’m working on a Python script that monitors the `/var/log/suricata/fast.log` file to detect intrusion attempts. When an intrusion is detected, the script sends an email alert to the administrator. Once it’s complete, I’ll be happy to share it with the community! 🙂

I’m looking to add a feature that will automatically block IP addresses involved in high-priority intrusion attempts. Specifically, I want the script to:

- Add the offending IP address to a block list or group.
- Create a rule to block traffic from that IP.

I’d like to handle this via a console command because I need to integrate it directly into my script.

Does anyone know how to block an IP address using a console command on Linux? Any guidance on how to implement this would be greatly appreciated.

I understand that this script might not be perfect, but I’m eager to learn and improve.

Thanks in advance for your help!

---

<div class="post-metadata">

**Author:** ![hvacguy](https://community.ipfire.org/user_avatar/community.ipfire.org/hvacguy/32/8576_2.png) [@hvacguy](https://community.ipfire.org/u/hvacguy)\
**Post date:** [19 August 2024 17:47 UTC](https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977/2 "2024-08-19T17:47:16Z")

</div>

Do you use this feature?  
[https://www.ipfire.org/blog/feature-spotlight-weaponising-ipfire-location-to-proactively-detect-fast-flux-setups](https://www.ipfire.org/blog/feature-spotlight-weaponising-ipfire-location-to-proactively-detect-fast-flux-setups)

---

<div class="post-metadata">

**Author:** ![kulm](https://community.ipfire.org/user_avatar/community.ipfire.org/kulm/32/15319_2.png) [@kulm](https://community.ipfire.org/u/kulm)\
**Post date:** [19 August 2024 18:11 UTC](https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977/3 "2024-08-19T18:11:29Z")

</div>

Hi UI,  
a rule to block an IP boils down to a simple iptables command. Without any finesse maybe “iptables -I INPUT -p all -s insertnaughtyIPhere -j DROP”. You can rely on the iptables manpage for details.  
If I understand correctly you would like to add your insight (bad IPs) to an “official” blocklist. If and how this can be done will certainly depend on their house rules.

---

<div class="post-metadata">

**Author:** ![hvacguy](https://community.ipfire.org/user_avatar/community.ipfire.org/hvacguy/32/8576_2.png) [@hvacguy](https://community.ipfire.org/u/hvacguy)\
**Post date:** [19 August 2024 18:28 UTC](https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977/4 "2024-08-19T18:28:40Z")

</div>

This may help

> [@Question for /etc/init.d/firewall](https://community.ipfire.org/t/question-for-etc-init-d-firewall/4281):
>
> Hello everyone, Is this a file provided by ipfire? and what kinds of rules are given? I have to provide iptables rules with a firewall file but I just saw that it already exists

---

<div class="post-metadata">

**Author:** ![nickh](https://community.ipfire.org/user_avatar/community.ipfire.org/nickh/32/9845_2.png) [@nickh](https://community.ipfire.org/u/nickh)\
**Post date:** [19 August 2024 18:30 UTC](https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977/5 "2024-08-19T18:30:40Z")

</div>

Can fail2ban be used for this rather than write a new app?

---

<div class="post-metadata">

**Author:** ![hvacguy](https://community.ipfire.org/user_avatar/community.ipfire.org/hvacguy/32/8576_2.png) [@hvacguy](https://community.ipfire.org/u/hvacguy)\
**Post date:** [19 August 2024 18:51 UTC](https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977/6 "2024-08-19T18:51:33Z")

</div>

I don’t see that as a addon for ipfire.  
Perhaps Guardian

> **[The Guardian 2.0 Addon](https://www.ipfire.org/docs/addons/guardian)**

---

<div class="post-metadata">

**Author:** ![nickh](https://community.ipfire.org/user_avatar/community.ipfire.org/nickh/32/9845_2.png) [@nickh](https://community.ipfire.org/u/nickh)\
**Post date:** [19 August 2024 19:24 UTC](https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977/7 "2024-08-19T19:24:53Z")

</div>

I understand it is not there, but would it be better to get it working in IPF rather than develop something new? Fail2ban is a purpose built solution to monitor logs and to ban IP’s from the monitor. It may need a bit of shoe-horning to get the configs set up for IPF

---

<div class="post-metadata">

**Author:** ![hvacguy](https://community.ipfire.org/user_avatar/community.ipfire.org/hvacguy/32/8576_2.png) [@hvacguy](https://community.ipfire.org/u/hvacguy)\
**Post date:** [19 August 2024 19:44 UTC](https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977/8 "2024-08-19T19:44:12Z")

</div>

Looks like Guardian is similar  
To fail2ban.

---

<div class="post-metadata">

**Author:** ![nickh](https://community.ipfire.org/user_avatar/community.ipfire.org/nickh/32/9845_2.png) [@nickh](https://community.ipfire.org/u/nickh)\
**Post date:** [19 August 2024 20:01 UTC](https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977/9 "2024-08-19T20:01:51Z")

</div>

Possibly. I have not investigated but from the screenshot, it only monitors SSH and webserver activity. F2b monitors all logs (and/or the journal on systemd systems)

---

<div class="post-metadata">

**Author:** ![user-ip](https://community.ipfire.org/user_avatar/community.ipfire.org/user-ip/32/10923_2.png) [@user-ip](https://community.ipfire.org/u/user-ip)\
**Post date:** [19 August 2024 21:07 UTC](https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977/10 "2024-08-19T21:07:33Z")

</div>

Thanks for all the answers! I will take a look at the other solutions once I finish this project. 🙂

For now, I’ve developed a script that adds the blocked IPs to the `/etc/sysconfig/firewall.local` file like this:

```auto
#!/bin/sh
# Used for private firewall rules

# See how we were called.
case "$1" in
  start)
        iptables -I CUSTOMINPUT -p all -s 192.168.1.234 -j DROP
        iptables -I CUSTOMINPUT -p all -s 100.120.120.120 -j DROP
        iptables -I CUSTOMINPUT -p all -s 200.20.20.20 -j DROP
        iptables -I CUSTOMINPUT -p all -s 21.22.23.24 -j DROP
        iptables -I CUSTOMINPUT -p all -s 20.20.20.20 -j DROP
        ## add your 'start' rules here
        ;;
  stop)
        ## add your 'stop' rules here
        ;;
  reload)
        $0 stop
        $0 start
        ## add your 'reload' rules here
        ;;
  *)
        echo "Usage: $0 {start|stop|reload}"
        ;;
esac

```

After rebooting the ipf, the rules appear in the `iptables -L` output under the `CUSTOMINPUT` chain:

```auto
Chain CUSTOMINPUT (1 references)
target prot opt source destination
DROP all -- 20.20.20.20 anywhere
DROP all -- 21.22.23.24 anywhere
DROP all -- 200.20.20.20 anywhere
DROP all -- 100.120.120.120 anywhere
DROP all -- 192.168.1.234 anywhere

```

However, I’m still able to reach the network from the host `192.168.1.234`:

 ![image](https://community.ipfire.org/uploads/default/original/2X/f/f62dce8142d4b8fddadf906eec27cbbd06a10af0.png)  
Does anyone know what might be happening? 🫠

Thanks!

---

<div class="post-metadata">

**Author:** ![user-ip](https://community.ipfire.org/user_avatar/community.ipfire.org/user-ip/32/10923_2.png) [@user-ip](https://community.ipfire.org/u/user-ip)\
**Post date:** [19 August 2024 21:08 UTC](https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977/11 "2024-08-19T21:08:59Z")

</div>

nop. Why do you ask?

---

<div class="post-metadata">

**Author:** ![nickh](https://community.ipfire.org/user_avatar/community.ipfire.org/nickh/32/9845_2.png) [@nickh](https://community.ipfire.org/u/nickh)\
**Post date:** [19 August 2024 21:14 UTC](https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977/12 "2024-08-19T21:14:13Z")

</div>

INPUT is for traffic to IPF itself. FORWARD is for traffic through IPF to and from the LAN behind.

And you don’t need `-p all` in your rules.

---

<div class="post-metadata">

**Author:** ![bbitsch](https://community.ipfire.org/user_avatar/community.ipfire.org/bbitsch/32/7420_2.png) [@bbitsch](https://community.ipfire.org/u/bbitsch)\
**Post date:** [19 August 2024 21:16 UTC](https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977/13 "2024-08-19T21:16:23Z")

</div>

A little annotation:  
Fail2ban is suited to ban illegal **login** attempts.  
Because it is ever a bad idea to allow logins to IPFire from outside ( red ), the tool isn’t an option. It should be located on the server. IMO

But the goal of @user-ip is different from this, I think.

---

<div class="post-metadata">

**Author:** ![user-ip](https://community.ipfire.org/user_avatar/community.ipfire.org/user-ip/32/10923_2.png) [@user-ip](https://community.ipfire.org/u/user-ip)\
**Post date:** [19 August 2024 21:29 UTC](https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977/14 "2024-08-19T21:29:08Z")

</div>

Yes I was trying to create a warning to an admin account based on the logs created by SURICATA and block this ips.  
But it’s great to learn about new tools. 🙂

---

<div class="post-metadata">

**Author:** ![nickh](https://community.ipfire.org/user_avatar/community.ipfire.org/nickh/32/9845_2.png) [@nickh](https://community.ipfire.org/u/nickh)\
**Post date:** [19 August 2024 21:40 UTC](https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977/15 "2024-08-19T21:40:29Z")

</div>

That was the origin of F2B, but it developed massively since it started. Now it is a general purpose tool to ban IPs based on string matching in log files. They do not have to be login attempts. In my old server I use it to protect the webserver from repeat queries as well as unauthorised connections to OpenVPN (not a failed login explicitly but a particular type of response the server would never get from its expected clients). I also have a number of different postfix filters to block other illegalities (connections which are not logons).

---

<div class="post-metadata">

**Author:** ![bbitsch](https://community.ipfire.org/user_avatar/community.ipfire.org/bbitsch/32/7420_2.png) [@bbitsch](https://community.ipfire.org/u/bbitsch)\
**Post date:** [20 August 2024 06:53 UTC](https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977/16 "2024-08-20T06:53:22Z")

</div>

Yes, F2B is much more than a logon filter.  
But the main main mechanism is the automaton for a Chomsky-3-language ( aka regular expression ). This demands the unencrypted packet, which is present in the connection end point only, with increasing use of SSL based protocols.  
Packets which shall be forwarded to internal devices leave log messages in IPFire, which are not really parseable for unwanted traffic, only.

---

<div class="post-metadata">

**Author:** ![nickh](https://community.ipfire.org/user_avatar/community.ipfire.org/nickh/32/9845_2.png) [@nickh](https://community.ipfire.org/u/nickh)\
**Post date:** [20 August 2024 07:55 UTC](https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977/17 "2024-08-20T07:55:04Z")

</div>

Sorry, but that is not right. F2B does not care about SSL as it does not look at packets. It only looks at logs. As long as a log event is generated which can be identified in some way by regex and contains an IP address, F2B can process it. Suricata logs can be monitored, as can any other ones.

---

<div class="post-metadata">

**Author:** ![bbitsch](https://community.ipfire.org/user_avatar/community.ipfire.org/bbitsch/32/7420_2.png) [@bbitsch](https://community.ipfire.org/u/bbitsch)\
**Post date:** [20 August 2024 08:11 UTC](https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977/18 "2024-08-20T08:11:23Z")

</div>

Suricata logs, for example, contain blocks of IPs. What do you want to block using the blocked IP?

---

<div class="post-metadata">

**Author:** ![nickh](https://community.ipfire.org/user_avatar/community.ipfire.org/nickh/32/9845_2.png) [@nickh](https://community.ipfire.org/u/nickh)\
**Post date:** [20 August 2024 08:26 UTC](https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977/19 "2024-08-20T08:26:53Z")

</div>

Please read the OP. The user wants to monitor the `/var/log/suricata/fast.log` and create an action from it. F2B can do that. It can even be configured just to mail a message without creating a firewall rule, if that is all you want, but it is more usual to use it to create a firewall rule.

---

<div class="post-metadata">

**Author:** ![bbitsch](https://community.ipfire.org/user_avatar/community.ipfire.org/bbitsch/32/7420_2.png) [@bbitsch](https://community.ipfire.org/u/bbitsch)\
**Post date:** [20 August 2024 09:04 UTC](https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977/20 "2024-08-20T09:04:00Z")

</div>

I read the OP. Maybe my old head needs some time to understand the goal. 😉

I can’t see a reason, why some computational power is invested to block IPs which are blocked by the IPS, yet.

[Next page](https://community.ipfire.org/t/blocking-an-ip-address-via-console-command/11977.md?page=2)