0

I've noticed a few bogon ip addresses in wireshark and other network monitoring. What is the easiest way to block them all rather than block each one at a time. eg when I run

    ip route show | grep ppp0 

I get 10.20.22.137 as one of the connections.

4
  • 1
    Technically the ip address in your example is not a bogon, it is a reserved private address, which means it is an internal network address. Your perimeter device should not be allowing anything like that in. Are you sure there is nothing on your network using that address?
    – blendenzo
    Jan 5, 2017 at 8:06
  • Thanks blendenzo. I've spent the past week trying to prevent nefarious uploads after a clean boot. I'm new to linux so might be missing some obvious steps. I have nothing else on my network (or should not have). I have one linux laptop connecting to internet via pppoe. That should be all. Can you please suggest how I can remove? I've been getting disconnects due to huge uploads and other dos type events.
    – user637251
    Jan 5, 2017 at 8:16
  • The ppp0 interface IS your pppoe connection. If you remove the ip-address or ppp0 interface, you have no connection to the internet.
    – Soren A
    Jan 5, 2017 at 8:41
  • Thanks soren but that is not my ip. That's why I checked it. there is another ip listed that is my own IP address. So, because I was curious, I checked ipinfo.io and it said this is a bogon ip. I'm not entirely sure what that means though I've googled it for a basic definition. I'm also unsure how it came to be listed in my network devices.
    – user637251
    Jan 5, 2017 at 14:59

2 Answers 2

2

Short answer

It sounds like you don't have a perimeter device between your computer and your DSL modem (or other similar PPPoE device). If this is the case, the easiest solution to your problem would be to get an inexpensive router and plug it in between your computer and your PPPoE connection. (If you want an inexpensive professional grade router, I've heard good things about this one.)

When you set up your router, I would strongly suggest that you do not plug it into your internet connection until you have first connected it to your computer, logged in to the control panel and changed the default password.

As an immediate temporary solution to hold you over until you can install a router, you can enable ufw (the unix firewall) on your laptop by running sudo ufw enable from a terminal.

More detailed explanation

PPPoE devices (like DSL modems) often do not perform any packet inspection. They are a direct link into the provider's network. You say "I have nothing else on my network (or should not have)," but you are most likely misunderstanding what constitutes your local network. You are plugged directly into your ISP's network, and you are on the same LAN with all of their other customers. (This is and incredibly unsafe and unwise thing to do, for more reasons than the problems you are experiencing.)

If you run hostname -I it will show you your network address. I would guess that it will be something like 10.20.xx.xx, which means the "bogon" addresses you are seeing are actually network neighbors. Try this: ping a few of the addresses you were seeing by running ping 10.20.22.137 for example. If you get a response, it means that another computer on the same local network as you has that address. (If you don't get a response from the first one you try, it's possible the device could just be offline. Try a few to get a better result.)

If you are even more curious, a program called arp-scan will show you a list of all of the other devices on the same network with you. More on that here. It is likely that there are hundreds (if not thousands) of other devices on the same network as you. (Be warned, though, that your ISP might not like you running arp-scan, as it is a tool that is generally only used by network administrators and hackers, so they might flag you as a potential hacker. Use it at your own risk.)

It is likely that most of the "nefarious" traffic you are seeing is actually from your network neighbors whose computers have been infected with viruses, and their computers are attacking yours without their knowledge.

Installing a perimeter device (such as a router) will prevent all of that nefarious traffic from ever reaching your computer, since the router will only forward on traffic that your computer requested. If you need to allow in certain unsolicited traffic (for example, if you are hosting a web server), you will need a more complex solution than this which will involve port forwarding and setting custom host.deny rules, but installing a perimeter device is still the first step.

1

Please try the following steps :

1 - First, install the iptables extension package called 'ipset' to block a set of IP addresses :

sudo aptitude install ipset

2 - Create a set identified with 'setname' and 'specified type' :

sudo ipset create bogons nethash

Here, "bogon" is a setname and "nethash" is type.

3 - Add an entry to the set :

Eg. sudo ipset --add bogons x.x.x.x/24

4 - Next, drop outgoing and incoming packets to and from these ipsets using iptables rules :

sudo iptables -A INPUT -m set --match-set bogons src -j DROP
sudo iptables -A INPUT -m set --match-set bogons dst -j DROP

5 - Then add the iptables rule to drop forwarding the packets from these ipsets ( if using your machine as a router) :

sudo iptables -A FORWARD -m set --match-set bogons src -j DROP
sudo iptables -A FORWARD -m set --match-set bogons dst -j DROP

6 - Check your current iptables rules :

sudo iptables -L 

7 - Check your ipset list :

sudo ipset list 

8 - Check man page for more info on "iptables" and "ipset".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .