Block an IP range with FreeBSD's 'route add'

Question

To block a single IP address I'm using the following:

/sbin/route add -host 192.168.0.0 127.0.0.1

Is it possible to block an range of the IP addresses using the route?

I have tried the tips found on google like:

/sbin/route add 192.168.0.0/24
/sbin/route add -net 192.168.0.0/24 -blackhole

But none of them seem to work.

Why are you not using one of the three built-in firewalls?? – Chris S Feb 11 '13 at 15:47 — Chris S, Feb 11 '13 at 15:47
Have you tried route add -net 192.168.0.0/24 127.0.0.1 ? – Feb 11 '13 at 15:27 — , Feb 11 '13 at 15:27

score 4 · Answer 1 · answered Feb 11 '13 at 15:41

Blackholing an IP:

/sbin/route add 192.168.0.1 127.0.0.1 -blackhole

Blackholing a range:

/sbin/route add -net 192.168.0.0/24 127.0.0.1 -blackhole

To make it permanent edit /etc/rc.conf:

static_routes=”d1 d2″
route_d1=”-net 192.168.0.0/16 127.0.0.1 -blackhole”
route_d2=”-net 10.0.0.0/8 127.0.0.1 -blackhole”

1 Answers1