Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just flushed my IPTables ruleset and I'm writing new rules. I'm going to keep it pretty simple. I'm basically denying any IPs for INPUT that isn't the 1 i'm using, then I'm going to open port 80, 443, and the port for PLESK. That's it.

When I iptables -L -v, it doesn't show the actual ports. It seems it gives names based on the list configured in /etc/services, so do I need to update this list if I moved PLESK to a different port and it will update the name accordingly? For the sake of keeping track (in case I write more rules) I'd like to at least see the name of the service I'm making a rule for when I check it.

For example, I moved my SSH port, but if I write a rule stating if that port is attempted more than 4 times in a minute, it will REJECT the IP, I want it to actually say ssh in my IPTables ruleset, not dpt:pc-telecommute or whatever the generic is.

So updating /etc/services does this?

share|improve this question
add comment

1 Answer

up vote 6 down vote accepted

Use -n with iptables to not map IPs or ports to names.

Don't change /etc/services. Really.

share|improve this answer
    
....errrrp.... well I did.... haha, Lemme get right on changing that back... thanks for the tip though, that works great too! –  RCNeil Dec 30 '11 at 20:59
    
If you want to see a bit more detail with rules when running iptables -nvL then create each rule using the comment match extension. –  James O'Gorman Dec 30 '11 at 21:01
    
so, I'm assuming I don't want to touch /etc/services because that's the name identified when starting/restarting/stopping any service? 22 I returned back to ssh (even though the Port has moved) but I did retitle my port using PLESK to PLESK. Does that mean my command /etc/init.d/psa commands will stop working? –  RCNeil Dec 30 '11 at 21:08
    
/etc/services is distributed by your operating system vendor so it may be over-written in OS updates. It lists standard services as assigned by IANA. You shouldn't change the IANA-supplied services. You may add your own custom ones, but similarly they may get over-written. –  James O'Gorman Dec 30 '11 at 21:10
    
ah. well at least I know to go to IANA to get that list back to it's original state. I only changed 2 things. Many thanks to both of you. –  RCNeil Dec 30 '11 at 21:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.