/commands/iptables/iptables-block-ip-address
iptables block an IP address: iptables -I INPUT -s 203.0.113.7 -j DROP
- tool
- iptables / nftables
- versions
- iptables 1.8
- os
- linux
sudo iptables -I INPUT -s 203.0.113.7 -j DROP inserts a rule at the top of the INPUT chain that discards every packet from that address. Use -I (insert) rather than -A (append): rules are evaluated in order and the first match wins, so an appended DROP placed after an ACCEPT for port 22 or 443 never sees that traffic. The rule takes effect immediately and lasts until reboot unless you save it.
sudo iptables -I INPUT -s 203.0.113.7 -j DROP # one address
sudo iptables -I INPUT -s 198.51.100.0/24 -j DROP # a whole range
sudo iptables -I INPUT -s 203.0.113.7 -p tcp --dport 22 -j DROP # only SSH from it
sudo iptables -I INPUT -s 203.0.113.7 -j REJECT # refuse instead of ignore
sudo iptables -L INPUT -n -v --line-numbers # check position and countersVariants
| Rule | Effect |
|---|---|
| -I INPUT -s ADDR -j DROP | Ignore all packets from ADDR to this host. |
| -I INPUT -s ADDR/24 -j DROP | Same for a network in CIDR notation. |
| -I INPUT -s ADDR -p tcp --dport 22 -j DROP | Block only one service for that address. |
| -I INPUT -s ADDR -j REJECT --reject-with tcp-reset | Refuse TCP connections with a reset (match -p tcp for this option). |
| -I OUTPUT -d ADDR -j DROP | Stop this host from sending to ADDR. |
| -I FORWARD -s ADDR -j DROP | Block it on a router or for forwarded (container, VM) traffic. |
| -I INPUT -m set --match-set blocklist src -j DROP | Block every address in an ipset in one rule. |
Many addresses: use ipset
One rule per address works for a handful. For hundreds, every packet walks a long chain. An ipset is a hash table the kernel checks in one step, and you add or remove members without touching the rule:
sudo ipset create blocklist hash:ip
sudo ipset add blocklist 203.0.113.7
sudo ipset add blocklist 198.51.100.23
sudo iptables -I INPUT -m set --match-set blocklist src -j DROP
sudo ipset list blocklistUse hash:net for CIDR ranges. ipset contents are not saved by iptables-save; save them with ipset save and restore them before the iptables rules at boot.
Confirm it works
iptables -L INPUT -n -v shows packet and byte counters per rule; the counter of the DROP rule grows while the blocked host keeps trying. -n matters: without it iptables tries reverse DNS for every address and the listing can hang.
Undo and persist
Delete the rule with the same specification and -D, as described in iptables delete a rule. To keep it after a reboot, save the ruleset as shown in save iptables rules permanently.
FAQ
Should I use DROP or REJECT?
DROP discards the packets silently, so the sender waits for a timeout. REJECT answers with an ICMP error (or a TCP reset with --reject-with tcp-reset), so the sender fails fast. DROP is common for hostile traffic, REJECT for your own networks where fast failure helps debugging.
Why is the blocked IP still reaching my Docker container?
Traffic to published container ports is forwarded, not delivered locally, so it goes through the FORWARD chain and Docker's own chains instead of INPUT. Docker documents the DOCKER-USER chain for rules like this one.
How do I block an IPv6 address?
Use ip6tables with the same syntax, for example ip6tables -I INPUT -s 2001:db8::7 -j DROP. iptables rules apply to IPv4 only.