0

I need to block all outgoing traffic to a domain with all its subdomains.

I tried to do something like this:

sudo ufw deny out from any to *.domain.com

but of course it doesn't work because it needs an IP number.

How can I do this?

terdon
  • 100,812
user3021729
  • 141
  • 1
  • 5
  • Note that neither UFW or iptables are domain-aware - they are only IP aware. They are not built to do base-domain filtration, you would need something more akin to a customized DNS server with RPZ zones to deny lookups from succeeding for that domain, and then point your system's DNS to that. I am writing instructions to do this myself for my blog, but no idea when I'll have a complete answer for that. – Thomas Ward Jan 31 '23 at 15:30
  • It seems like /etc/hosts would be a good approach if I understood the question the way it was intended. I found https://superuser.com/questions/773635/block-network-access-to-a-domain-ubuntu to have a good answer to this. The answer I found most helpful is this one: https://superuser.com/a/773636/172474 – Karl Henselin Jan 31 '23 at 15:18
  • Both answers you've provided links to do not cover subdomains. Which is what OP wants. – Thomas Ward Jan 31 '23 at 15:29

1 Answers1

2

You can do this more reliably with hosts.deny in just a few seconds:

  1. Open Terminal (if it’s not already open)
  2. Edit hosts.deny as root: 
    sudo vi /etc/hosts.deny
  3. At the bottom of the file, add: 
    ALL : .domain.com
  4. Save the file

The preceding dot in .domain.com is important. Do not forget it