I know how to block certain website, like if I want to block google I can use this line in the host www.google.com.hk

But my question is how can I block certain IP address? Like how can I block certain IP address like


3 Answers 3


Technically, OS X can make use of /etc/hosts.allow and /etc/hosts.deny files that will work with standard resolvable hostnames. For blocking IP addresses, using iptables is the usual method but apparently Apple deprecated its use beginning with Lion and switched to pf for this function. Check and read the links in this thread on SuperUser for info on using pf and perhaps a GUI front-end for it.

  • hosts.allow and hosts.deny restrict access to your own Unix or Linux machine - even fine-grained to single services. Source
    – klanomath
    Nov 3, 2014 at 16:31
  • @klanomath Certainly, using something like deny tcp .google.com to block TCP connections. iptables has fine-grained functions as well.
    – douggro
    Nov 3, 2014 at 16:39
  • iftables/pf are effective means but hosts.allow/deny doesn't help much blocking outgoing traffic
    – klanomath
    Nov 3, 2014 at 16:43
  • @klanomath Yes, that would be better addressed through the router or external firewall. But it will kill the incoming response.
    – douggro
    Nov 3, 2014 at 16:59

Little Snitch (or similar) blocks IP addresses & IP Ranges for both outgoing & incoming connections.


You may execute a reverse DNS lookup to determine a hostname you want to block. Use a web service like reverse DNS lookup or 'nslookup' to get a hostname.


  1. Start Terminal.app and enter nslookup
  2. At the prompt enter server (this defines which dns-server to use to do the reverse DNS lookup. is a google name server)
  3. At the next prompt enter an ip-address
  4. Now you'll get the host name you need for your hosts file

Example output:

user$ nslookup
> server
Default server:

Non-authoritative answer:  name = p5DDC6637.dip0.t-ipconnect.de.

If you add p5DDC6637.dip0.t-ipconnect.de to your hosts file you will prevent your computer accessing my web server.


A lot of ip-addresses and correspondent host names can't be tied to a special computer/host. Mine change at least every 24 hours.

A today hazardous site/hostname might be a valuable one in the future but unaccessible for you.

Some ip-addresses are tied to several hostnames with the consequence that you won't be able to detect the name you actually want to block.

  • this is answering a different question: how to block access to a host-name or domain name. It will NOT work if someone will use the IP address directly (in the browser, or any other software that makes the TCP/IP connection, May 24, 2016 at 10:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .