How do I list IP addresses blocked by iptables?

Question

To prevent brute force attacks against ssh I've added some iptables rules (below). The question is: How can I list the blocked IP addresses?

(1)
iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 8 --rttl --name SSH -j DROP

Answer 1

One option would be to log any of your dropped packets with a rule like:

iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 8 --rttl -j LOG --log-prefix "FW_DROPPED: "

Insert that immediately before the DROP rule. Then, you can grep the syslog file for anything with "FW_DROPPED" in it and the list of IPs will be there. The entries in the log file look something like this:

Jun  3 08:05:57 some-machine kernel: [15852451.420557] FW_DROPPED: IN=eth0 OUT= MAC=00:50:ba:4a:d9:e3:00:12:17:3a:e3:64:08:00 SRC=228.23.45.189 DST=192.168.1.1 LEN=48 TOS=0x00 PREC=0x00 TTL=106 ID=10941 PROTO=TCP SPT=58212 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0

So, snipping out what follows "SRC=" will show you the dropped IPs. Sort that, eliminating duplicates, and you'll have your list.

I've found the Iptables Tutorial to be the most useful documentation for iptables/netfilter.

Answer 2

You can find details under /proc/net/ipt_recent/SSH.

This article has more information.

Answer 3

Look at

/proc/net/ipt_recent/YOURNAME

where YOURNAME is the name you used with --name option in your iptables rule.

Answer 4

What I do, for example for input address spoofing, is to define the chain SPOOF_REJECT:

iptables -N SPOOF_REJECT
iptables -A SPOOF_REJECT -j LOG --log-prefix "Input spoof detected: "
iptables -A SPOOF_REJECT -j REJECT

then to send packets to this chain if they are spoofed:

iptables -A INPUT -i $EXT_DEV1 -s $INT_NET -j SPOOF_REJECT
iptables -A INPUT -i $EXT_DEV2 -s $INT_NET -j SPOOF_REJECT

You could do something like this for each category of packets you drop or reject to get a line in the syslog to look for, then periodically grep, cut, sort, to get just the IP addresses from these log lines.

The benefit to using individual chains for each category is that your configuration gets more straightforward and it gets easier to read your iptables configuration. As you add more and more rules, you'll be glad that you used individual chains for specific different actions.