特殊IP地址
特别是，我正在寻找一个可以放入我的 hosts 文件中的 IP 地址，该文件将黑洞给定的 DNS 名称。 现在我正在使用 127.0.0.1 但如果我安装了任何服务，就会开始表现得很奇怪。
如何防止第 3 方程序联系给定服务器？
In particular I'm looking for an IP address that I can put in my hosts file that will black-hole a given DNS name. Right now I'm using 127.0.0.1 but that would start acting odd if I installed any services.
How can I prevent a 3rd party program from contacting a given server?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（9）
RFC-3330 似乎是金矿
最好的选择似乎是：
RFC-3330 seems to be the goldmine
The best option seems to be:
实际上环回IP 127.0.0.1 是广告拦截的理想选择。 如果您无论如何运行 Apache，您将设置一个虚拟服务器，该服务器对于 127.0.0.1 上的请求返回 404。 这样您的浏览器就不会一直等待连接到未知主机的超时。 所有这些广告请求都会立即返回，从而释放浏览器中的资源以获取实际的页面内容。
Actually the loopback IP 127.0.0.1 is ideal for ad blocking. If you run Apache anyway, you setup a virtual server that returns 404 for requests on 127.0.0.1. That way your browser is not constantly waiting for the connect to an unknown host to timeout. All those ad requests return instantly, freeing up resources in your browser to get the actual page content.
我在主机文件中使用 0.0.0.0 来阻止广告网站。 不知道有没有副作用？！？！
I've used 0.0.0.0 in my hosts file to block ad web sites. Not sure if there are any side affects?!?!
我发现您正确地发现 192.0.2.0/24 是保留用于测试的，并且不会出现在 Internet 上。
但是，如果您的局域网依赖默认路由来到达互联网的其余部分，那么您仍然会将该流量从您的网络发送到您的 ISP。
最好的情况是您的 ISP 将发回
ICMP_NET_UNREACHABLE错误，您的应用程序将注意到这些错误并采取相应的行动。 最坏的情况是流量完全被黑洞，此时您的应用程序将一直闲置，直到连接超时。避免这种情况的正确策略取决于您的操作系统和本地网络配置。 在 Linux 系统上，我只需为 /24 添加一条以“reject”为目标的路由。
I see that you've correctly found that 192.0.2.0/24 is reserved for testing, and won't appear on the Internet.
However if your local area network relies on a default route to get to the rest of the Internet then you'll still be sending this traffic out of your network towards your ISP.
Best case is that your ISP will send back
ICMP_NET_UNREACHABLEerrors and your applications will notice those and act accordingly. Worst case is that the traffic is completely blackholed, at which point your applications will sit around until the connections timeout.The correct strategy for avoiding this depends on your OS and local network configuration. On a Linux system I'd just add a route for that /24 with "reject" as a target.
地址 127.0.0.0 到 127.255.255.255 可用于环回连接。
因此，让您的 httpd 侦听 127.0.0.1 并使用任何其他端口作为黑名单。
Addresses 127.0.0.0 to 127.255.255.255 can be used for loopback connections.
So have your httpd listening on 127.0.0.1 and use any of the others for the blacklist.
如果您使用任何未连接到的私有 IP 地址范围（10.whatever、192.168.whatever），则应该可以使用。
If you use any of the private IP address ranges (10.whatever, 192.168.whatever) that you aren't connected to that should work.
使用 127.0.0.1 的优点之一是，尝试联系服务器将立即返回失败（当然，只要您没有运行本地服务器）。 如果您使用不引用特定计算机的任何其他地址（例如 192.0.2.x），则尝试连接到该地址的服务器将需要一段时间（至少一分钟或更长时间）。
One advantage of using 127.0.0.1 is that an attempt to contact the server will return immediately with failure (as long as you're not running a local server, of course). If you use any other address that does not refer to a specific machine, such as 192.0.2.x, then attempts to connect to a server at that address will take some time to time out (at least a minute or more).
我使用 denyhosts 进行 ssh。 http://denyhosts.sourceforge.net/ 它尝试阻止已知的恶意来源。 你说的是这个吗？
I use denyhosts for ssh. http://denyhosts.sourceforge.net/ It attempts to block known malicious sources. Is this what you're talking about?
0.0.0.0（正如另一张海报所说）不应该被使用 - 它有一个独特的含义，不是“什么都没有”，并且它不是为大多数情况下的死胡同而保留的。 至于 BCS 向 dulaneyb 发表的有关 DCHP 和私有范围的评论 - 私有范围就是私有范围。 如果您踢到您的私人范围，那么您将路由到一个空位置。 如果您要踢到其他私有范围之一，则上游设备应该将其丢弃。
0.0.0.0 ( as another poster put ) shouldn't be used - it has a distinct meaning that isn't "nothing" and it isn't reserved for what in most cases is a dead-end. As for BCS's comment to dulaneyb about DCHP and private ranges - a private range is a private range. If you're kicking to your private range, then you're routing to an empty slot. If you're kicking to one of the other private ranges, then an upstream device should drop it.