Blocking an incoming traffic from a specific host

[Bolek Mynarski]

I've been scraching my head now for quite some time, browsing through various message board in hope of finding an answer to my problem. No luck. My problem is that I have a pesky workstation going around and collecting info generating lots of traffic. I want to prevent it from scanning my box (HP-UX 11.00 9000). I've tried the following:

/usr/sbin/route add net 10.28.13.15 netmask 255.255.255.0 127.0.0.1

This produces an error "no route to host."

I tried /usr/sbin/route add net 10.28.13.15 127.0.0.1 with the same result.

My question is, how can I block traffic from that system to my server?

Thanks.

[Sridhar Bhaskarla]

Hi,

This really falls under security category. You will need to user tcp wrappers to wrap up the TCP ports or atleast you can use /var/adm/inetd.sec to control the inetd services. Look at this file and you will find good examples and format of the file.

Now, this will not stop the other system scanning your server. At the most he/she will get "connection refused" messages to the services that are blocked in inetd.sec file.

Disable unused services from inetd.conf and /etc/services and restart inetd.

Use a firewall if the system is not on the same network.

-Sri

[Uday_S_Ankolekar · Accepted solution]

Hi,
You can use ipfilter for this. Also /var/adm/inetd.sec file can control incoming traffic.

Have a look at this doc for ipfilter

http://us-support.external.hp.com/cki/bin/doc.pl/sid=666b91550030208429/screen=ckiDisplayDocument?docId=200000056482653

-USA..

[Rita C Workman]

If your talking about stopping it to a server (i.e. not keeping out of your whole network)...than have you tried adding somethings to your /var/adm/inetd.sec

telnet deny
rlogin deny

etc...

Just a thought,
Rita