0

How can I redirect an IP say 203.130.48.8-bj-cnc or 203.130.48.8 to Google.com in host file (or other places)?

It looks like host file doesn't redirect an ip address (only the domain names).

1

Since 203.130.48.8-bj-cnc (subtype ip address) and 203.130.48.8 (traditional ip address) are "ip address" instead of "alias," adding them in host file will not do anything. The system will bypass the rules you set up.

The only way to redirect ip request is to use third party software like little snitch. They are usually not free. This is because Unix based system will go through ip address directly when requesting instead of wasting time on capture them to enhance performance. Third party software basically reduce the overall efficiency by query ip requests.

Another way to do it is to set up rules in your gateway, that's only if your gateway can do it and if you have a gateway to begin with.

I know host file is probably the most convenient way to deal with this, but it simply won't work. Move on, stop wasting time on it.

3

You don't specify whether you want to block incoming traffic from that host name or outgoing or both. You also don't mention what version of Mac OS X you are running and whether or not you are trying to block that host with a specific application like Little Snitch or similar. Some logs would be helpful as well. Consult this page to help you formulate better questions for the community to be able to answer.

203.130.48.8-BJ-CNC is a valid hostname according to IETF standard RFC 952.

A "name" (Net, Host, Gateway, or Domain name) is a text string up to 24 characters drawn from the alphabet (A-Z), digits (0-9), minus sign (-), and period (.).

To block outgoing traffic to it, use the hostname in your /etc/hosts file like so:

127.0.0.1    203.130.48.8-bj-cnc

Then do:

sudo dscacheutil -flushcache

to load the new rules.

If you want to be able to block outgoing traffic to the actual ip address of the machine you'll need to use Mac's builtin packet filter (originally from OpenBSD's excellent PF. A pf.conf rule would look like this:

block out log quick on $ext_if proto { tcp, udp, icmp } to 203.130.48.8

Blocking incoming traffic from that ip is generally handled just fine by using Mac OS X's default application firewall in  -> System Preferences -> Security & Privacy -> Firewall. Alternatively you can set the policy via the commandline like so:

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setblockall on

for thoroughness, you may also want to block all icmp requests:

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmod on

and finally enable it thus:

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
8
  • Hi, it looks like 203.130.48.8-bj-cnc is actually an IP address rather than a host name, this is why "127.0.0.1 203.130.48.8-bj-cnc" doesn't work. – aeroxy Apr 7 '14 at 2:22
  • hostnames are allowed to have numbers in them. So 203.130.48.8-bj-cnc is a valid hostname even though it contains an ip address in it. You need to make sure that you flush the dns cache of your machine after inputting the rule. Tested and working on Mac OS X Mavericks. sudo vi /etc/hosts | grep 203.130.48.8-BJ-CNC # test block 203.130.48.8-BJ-CNC 127.0.0.1 203.130.48.8-BJ-CNC ping 203.130.48.8-BJ-CNC PING 203.130.48.8-bj-cnc (127.0.0.1): 56 data bytes 64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.067 ms – VogonPoetLaureate Apr 11 '14 at 15:47
  • Have you tested if it works when you redirect this "host name" to a new ip address? If so can you upload your host file? Thanks. – aeroxy Apr 11 '14 at 17:23
  • See my comment above. The test is to ping the hostname and the response indicates 127.0.0.1 which is the localhost (your machine). # test block 203.130.48.8-BJ-CNC in /etc/hosts 127.0.0.1 203.130.48.8-BJ-CNC – VogonPoetLaureate Apr 12 '14 at 2:14
  • I am pretty sure it doesn't work. Have you tried hosting a local web page and visit the 'host name' in your browser? Ping only gives you the idea how fast the server responses. – aeroxy Apr 12 '14 at 11:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .