Filtering by IP address Allowing or denying a connection based on IP address is very straightforward. Where x.x.x.x is the IP address you want to block. Also, you can define an optional subnet mask. The number after the slash refers to the number of bits in the subnet mask. You can also specify the protocol you want to filter by using the -p switch.
Valid protocols are tcp, udp, icmp, or all.
A situation may arise where you need to control access to a particular port. The most common situation for this type of blocking is when an insecure or suspect service is being run on a certain port. For instance, rlogin. If the hostname matches what's in a person's .rhosts file, the attacker would be able to login. You can also use a range of ports.