I've noticed a few bogon ip addresses in wireshark and other network monitoring. What is the easiest way to block them all rather than block each one at a time. eg when I run
ip route show | grep ppp0
I get 10.20.22.137 as one of the connections.
It sounds like you don't have a perimeter device between your computer and your DSL modem (or other similar PPPoE device). If this is the case, the easiest solution to your problem would be to get an inexpensive router and plug it in between your computer and your PPPoE connection. (If you want an inexpensive professional grade router, I've heard good things about this one.)
When you set up your router, I would strongly suggest that you do not plug it into your internet connection until you have first connected it to your computer, logged in to the control panel and changed the default password.
As an immediate temporary solution to hold you over until you can install a router, you can enable ufw (the unix firewall) on your laptop by running
sudo ufw enable from a terminal.
PPPoE devices (like DSL modems) often do not perform any packet inspection. They are a direct link into the provider's network. You say "I have nothing else on my network (or should not have)," but you are most likely misunderstanding what constitutes your local network. You are plugged directly into your ISP's network, and you are on the same LAN with all of their other customers. (This is and incredibly unsafe and unwise thing to do, for more reasons than the problems you are experiencing.)
If you run
hostname -I it will show you your network address. I would guess that it will be something like 10.20.xx.xx, which means the "bogon" addresses you are seeing are actually network neighbors. Try this: ping a few of the addresses you were seeing by running
ping 10.20.22.137 for example. If you get a response, it means that another computer on the same local network as you has that address. (If you don't get a response from the first one you try, it's possible the device could just be offline. Try a few to get a better result.)
If you are even more curious, a program called
arp-scan will show you a list of all of the other devices on the same network with you. More on that here. It is likely that there are hundreds (if not thousands) of other devices on the same network as you. (Be warned, though, that your ISP might not like you running arp-scan, as it is a tool that is generally only used by network administrators and hackers, so they might flag you as a potential hacker. Use it at your own risk.)
It is likely that most of the "nefarious" traffic you are seeing is actually from your network neighbors whose computers have been infected with viruses, and their computers are attacking yours without their knowledge.
Installing a perimeter device (such as a router) will prevent all of that nefarious traffic from ever reaching your computer, since the router will only forward on traffic that your computer requested. If you need to allow in certain unsolicited traffic (for example, if you are hosting a web server), you will need a more complex solution than this which will involve port forwarding and setting custom host.deny rules, but installing a perimeter device is still the first step.
Please try the following steps :
1 - First, install the iptables extension package called 'ipset' to block a set of IP addresses :
sudo aptitude install ipset
2 - Create a set identified with 'setname' and 'specified type' :
sudo ipset create bogons nethash
Here, "bogon" is a setname and "nethash" is type.
3 - Add an entry to the set :
Eg. sudo ipset --add bogons x.x.x.x/24
4 - Next, drop outgoing and incoming packets to and from these ipsets using iptables rules :
sudo iptables -A INPUT -m set --match-set bogons src -j DROP sudo iptables -A INPUT -m set --match-set bogons dst -j DROP
5 - Then add the iptables rule to drop forwarding the packets from these ipsets ( if using your machine as a router) :
sudo iptables -A FORWARD -m set --match-set bogons src -j DROP sudo iptables -A FORWARD -m set --match-set bogons dst -j DROP
6 - Check your current iptables rules :
sudo iptables -L
7 - Check your ipset list :
sudo ipset list
8 - Check man page for more info on "iptables" and "ipset".