How to block access to a particular website

The following terms are used in the article:

Description

It is required to block access for all VMs to a certain IP address, website, or resource.

To block access to a website, add a rule to the PREROUTING chain. See below for two options of blocking access:

Important

The solution was tested on the Switching network type. For other network types, the rule may be different.

Note

The register in the PREROUTING chain name depends on your OS. To define a register, run the command:

nft list ruleset

Blocking with rule saved after restart is performed via table bridge nat and works for virtual machines on a bridge network.

To block access to a website:

Identify the IP addresses of the website:

dig +short <website_address>

Example output

dig +short <website_address>
10.10.10.1
10.10.11.1

Connect to the cluster node via SSH. For more information about connecting via SSH, see Workstation setup.
Open the /etc/nftables/vmmgr.nft file in edit mode.

Add or modify the bridge nat table as in the example below:

table bridge nat { chain PREROUTING { type filter hook prerouting priority dstnat; policy accept; ip daddr { 10.10.10.1, 10.10.11.1 } drop } }

Comment

To block access to a website:

Identify the IP addresses of the website:

dig +short <website_address>

Example output

dig +short <website_address>
10.10.10.1
10.10.11.1

To unblock, delete the rule you created:

The article was last updated on 07.11.2025. The article was prepared by technical writers of ISPsystem