Linux Firewall/IPtables - how to find specific IP address (range), block, unblock addresses?

Question

1) What is the best way how to check if IP address is blocked by a firewall?

I know this method:

iptables -L -n --line | grep 111.222.333.444

However, if the firewall has blocked an IP address range, for example, 111.222.333.444/19 but I search for 111.222.333.456, it will not return any results. How can I find check specific IP address if a whole range is blocked?

2) If firewall has blocked some IP address, what does mean the first and the second line in the search results:

489  DROP       all  --  11.222.333.444/19      0.0.0.0/0
490  DROP       all  --  0.0.0.0/0            11.222.333.444/19

How can I unblock IP address or IP address range? Is it correct?:

iptables -I INPUT -s 111.222.333.444 -j ACCEPT

(I want just unblock, not to put in a whitelist).

3) Is this correct if I want to block an IP address in my server?

iptables -A INPUT -d 111.222.333.444 -j DROP

Do I need to restart/reload ... firewall after blocking/unblocking IP addreses?

Thanks.

Answer 1

1) You are going to have to not grep the iptables output, but rather process the output, turning the IP subnets that are blocked into a bitmask that you can compare against the address you are interested in. This can be done in scripting languages like Perl or Python.

2a) The two lines refer to incoming and outgoing data -- the firewall will block attempts by that network to communicate with your server/network, and attempts by your server/network to communicate with that network. (This is a courtesy to them, so you don't send a connection request that they could never respond to, for example.)

2b) In order to unblock an IP or network, you can simply remove it from the list entirely. If you want to keep a network blocked, but still allow access from one particular address in that network, you will have to insert two ACCEPT rules at the top of the INPUT chain, one to allow incoming traffic, and one outgoing:

iptables -I INPUT 1 --src 111.222.333.444 -j ACCEPT
iptables -I INPUT 1 --dest 111.222.333.444 -j ACCEPT

This will effectively put those addresses in a whitelist, as you indicate you don't want to do. So your options are a bit limited here.

3a) Assuming you have no ACCEPT rules in the INPUT chain, yes. If you do, you should insert those rules at the top of the table using -I INPUT 1 instead of -A INPUT. But the example you provide will only block packets being sent from your network to theirs. Be sure to add another rule with -s or --src instead of -d if you want to block incoming traffic from their network too.

3b) Changes made with the iptables command take effect immediately. However, they may not be persisted on reboot, depending on your configuration.