You don't need to specify the protocol, and you don't need to specify the /32
ie.
iptables -A INPUT -s 192.168.0.1 -j DROP
If you are only banning the ip from, say, SSH access, then that line would become :
iptables -A INPUT -p tcp -s 192.168.0.1 --dport 22 -j DROP
Change --dport to whatever services port you are denying to that IP.
If you want this ban to be permanent, then you need to save iptables and then restart it to read in the new values.
On RHEL this would be :
service iptables save
then
service iptables restart
I had issues with certain IPs hammering SSH on my server, so I wrote a small shell script to make it easier to ban ips manually -
CODE
#!/bin/bash
# This script makes banning ip addresses from ssh access easier
# This script needs to be run as root, so if you don't understand it, you shouldn't really run it !
# No responsibility for locking you out of your own server is assumed !!
# define variables here #
address=$1 # address=$1 gets the ip passed from the command line
file="/etc/sysconfig/iptables" # where to check for duplicate entries
quit=n # preset the quit variable so we can run the loop
################################################################################
##
#################### sub routine that actually checks for duplicates ####
#################### or adds new rules to iptables, plus a few escape options ####
################################################################################
##
process(){
read confirm
case $confirm in
y) if grep -q $1 $2 # If the inputted address matches a rule
# in the existing tables
then
echo -e "\E[0;31m$1 is already banned"; tput sgr0
unset address;
sleep 2
else # If no existing match, add rule and restart iptables
iptables -A INPUT -p tcp -s $1 --dport 22 -j DROP;
service iptables save;
service iptables restart;
echo -e "\E[0;32m$1 has been banned"; tput sgr0
unset address
sleep 5
fi
clear;;
n) echo "Information discarded" # cancel that request, try again
unset address
sleep 1
clear;;
q) quit=y;; # just quit already
*) echo "Invalid response !" # WTF was that ?
sleep 1
clear;;
esac
}
######################################## ######################################## Start of input script ##################
clear
while test "$quit" = "n"
do
if [ $address ]; then # did we get an ip on the command line ?
case $address in
q) quit=y;;
*) echo -e '\E[0;31mIPTABLES IP Banning Utility Ready'; tput sgr0
echo -n "$address will be banned from ssh access, is this ok ? [y],[n],[q]:";
process $address $file # jump to main function
esac
else # ok, we're starting from scratch, no command line arguments
echo -e '\E[0;31mIPTABLES IP Banning Utility Ready'; tput sgr0
echo "Please enter the IP address to be banned from ssh access attempts"
echo -n "(q to quit now)":
read address
case $address in
q) quit=y;;
*) echo -n "$address will be banned from ssh access, is this ok ? [y],[n],[q]:";
process $address $file # jump to main function
esac
fi
done
I saved this as a file called ban.sh (located in roots home directory)
chmod 700 and owned by root
So I can ban an address like this :
Login to server over SSH
su - to root
then type :
ban 192.168.0.1
or just type ban and follow the prompts.
This script is set up for use on RHEL, so it may need modifying for other distros.
All the parameters are explained using man iptables.
