Block (or only allow certian) incoming IP addresses on Verizon FIOS Actiontec Router

fiosfirewallip

I opened a few ports to the outside of my home network so I can get into a few of my machines from outside. When checking some logs, I noticed that I was getting scanned on some ports from various other countries.

I already moved my port forward to a non-standard port.

I would like to be able to block specific IP's (or even subnets) from my Verizon FIOS router. There is a little bit of documentation online, but I can't find anything specific on how to do this.

To start, I just want to block a specific IP. But if it is not to hard, I would also like to know how to possibly block a range of IPs. And with the inverse of this – is there a way to allow only certain IPs or range?

Best Answer

Actiontec Router? In the Firewall section go to the Advanced Filtering section (Network (Home/Office) Rules) > Add, you can set filters (Rules) in there, specify the IP, the protocol and set it to "drop" packets, no real way to keep open ports from port scanners, this will be a constant battle as the IPs will constantly change.

Do not set it up to "reject" packets, this will send a reply, and will indicate that you exist on the other end. Set it to "Drop" packets.

Network Home/Office includes all the underlying networks including, Ethernet, Coax, Wireless.

It is not really a problem, since unsolicited packets will not get through the nat table or firewall anyway. Be sure the firewall is set to medium.

Related Solutions

How to replace the Verizon FIOS Router

This FAQ is a really good reference for dealing with various FiOS networking issues. The bottom line is that if you have TV through FiOS, you simply can't get rid of the provided router completely. However, you can augment the provided router with your own and depending on how complex you want to get, the ActionTec can essentially act as a dedicated router just for the set-top boxes.

This option is the one I'm planning on going with once my FiOS order gets setup.

How to Allow Only One Country in Ubuntu IPTables – Firewall Configuration

You will need to add the iptables support for geolocation. To do so, you'll have to follow these steps:

# apt-get install xtables-addons-common
# mkdir /usr/share/xt_geoip
# apt-get install libtext-csv-xs-perl unzip
# /usr/lib/xtables-addons/xt_geoip_dl
# /usr/lib/xtables-addons/xt_geoip_build -D /usr/share/xt_geoip *.csv

This will allow you to do things like:

iptables -A OUTPUT -m geoip --dst-cc CN -j DROP

That would block any outgoing traffic to China (CN). The complexity of the rules is up to you, basically you don't need a script, just write down the rules you want to apply and then use iptables-save so they are loaded each time you reboot.

Best Answer

Related Solutions

How to replace the Verizon FIOS Router

How to Allow Only One Country in Ubuntu IPTables – Firewall Configuration

Related Question