Trying to block a single IP Address

[Chris_305]

I have installed IP Filter 9000 on my HP Server running HP-UX 11.i and can't seem to figure out how to block one single IP Address. Doing a full subnet is easy but I need to only block one single IP Address because I need the rest of the network to access this machine.
example I Have a private IP Address of 10.23.206.52 and want to block incoming traffic from 10.23.249.50.

Any info on this would be appreciated.

[Zafar A. Mohammed_1]

Access control to individual network services can be set in /var/adm/inetd.sec, an optional security file for the Internet daemon.
You can explicitly allow or deny use of most networking services by listing them on a per-machine or per-subnet basis. The syntax of entries in /var/adm/inetd.sec is:
service-name allow|deny { host-address| host-name}...

The service-nameis the official name (not an alias) of a valid service in the file /etc/services. The service-name for RPC-based services(NFS) is the official name (not an alias) of a valid service in the file
/etc/rpc. The wildcard character * and the range character - are permitted in addresses.


Thanks
Zafar

[Michael Tully]

The easiest way to block a single IP address is to use the /var/adm/inetd.sec file.
The man page gives some good example on the syntax.

[Chris_305]

I am trying to block all traffic from an IP address not just some services like inetd.sec does.

[Kelli Ward]

Someone correct me if I am wrong;
I believe if you install (or have installed) tcp_wrappers, you can add an entry in /etc/hosts.deny of
ALL : 10.23.249.50

Not sure of a shotgun way to do it with inetd.sec

Good luck,
Kel

[Bill Hassell]

Download tcp_wrappers from software.hp.com since as you've mentioned, inetd.sec covers only selected services.

[U.SivaKumar_2]

Hi,

On the HP-UX server

#route add 10.23.206.52 xx.xx.xxx.xxx 1

Here xx.xx.xxx.xxx is an unused IP address in your local network.

Now that particular client will be blocked.

regards,

U.SivaKumar

[U.SivaKumar_2]

Hi,

This should also work

#route add 10.23.206.52 127.0.0.1

regards,

U.SivaKumar

[Wodisch]

Hi Chris,

since aou already use "IP Filter" I guess you simply missed the obvious: use the netmask "/32" and be done...

FWIW,
Wodisch