I know how to block certain website, like if I want to block google I can use this line in the host www.google.com.hk

But my question is how can I block certain IP address? Like how can I block certain IP address like


Technically, OS X can make use of /etc/hosts.allow and /etc/hosts.deny files that will work with standard resolvable hostnames. For blocking IP addresses, using iptables is the usual method but apparently Apple deprecated its use beginning with Lion and switched to pf for this function. Check and read the links in this thread on SuperUser for info on using pf and perhaps a GUI front-end for it.

  • hosts.allow and hosts.deny restrict access to your own Unix or Linux machine - even fine-grained to single services. Source – klanomath Nov 3 '14 at 16:31
  • @klanomath Certainly, using something like deny tcp .google.com to block TCP connections. iptables has fine-grained functions as well. – douggro Nov 3 '14 at 16:39
  • iftables/pf are effective means but hosts.allow/deny doesn't help much blocking outgoing traffic – klanomath Nov 3 '14 at 16:43
  • @klanomath Yes, that would be better addressed through the router or external firewall. But it will kill the incoming response. – douggro Nov 3 '14 at 16:59

Little Snitch (or similar) blocks IP addresses & IP Ranges for both outgoing & incoming connections.


You may execute a reverse DNS lookup to determine a hostname you want to block. Use a web service like reverse DNS lookup or 'nslookup' to get a hostname.


  1. Start Terminal.app and enter nslookup
  2. At the prompt enter server (this defines which dns-server to use to do the reverse DNS lookup. is a google name server)
  3. At the next prompt enter an ip-address
  4. Now you'll get the host name you need for your hosts file

Example output:

user$ nslookup
> server
Default server:

Non-authoritative answer:  name = p5DDC6637.dip0.t-ipconnect.de.

If you add p5DDC6637.dip0.t-ipconnect.de to your hosts file you will prevent your computer accessing my web server.


A lot of ip-addresses and correspondent host names can't be tied to a special computer/host. Mine change at least every 24 hours.

A today hazardous site/hostname might be a valuable one in the future but unaccessible for you.

Some ip-addresses are tied to several hostnames with the consequence that you won't be able to detect the name you actually want to block.

  • this is answering a different question: how to block access to a host-name or domain name. It will NOT work if someone will use the IP address directly (in the browser, or any other software that makes the TCP/IP connection, – Motti Shneor May 24 '16 at 10:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .