Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running a Centos 6.0 server, with Apache 2/MySQL. I've got iptables running. I followed these steps tonight to block all traffic from an IP using iptables:

iptables -A INPUT -s xxx.xxx.xxx.xxx -j DROP
iptables -A OUTPUT -d xxx.xxx.xxx.xxx -j DROP
service iptables save
service iptables restart

But I'm still seeing hits from this IP in my Apache access logs constantly, even after I restart Apache. iptables is definitely running and it's definitely the right IP address.

These are the rest of my iptables entries:

Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     all  --  anywhere             anywhere            
2    REJECT     all  --  anywhere             loopback/8          reject-with icmp-port-unreachable 
3    ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
4    ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http 
5    ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https 
6    ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:30000 
7    ACCEPT     icmp --  anywhere             anywhere            icmp echo-request 
8    REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         
1    REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     all  --  anywhere             anywhere

What am I missing?

share|improve this question

4 Answers 4

up vote 3 down vote accepted

At first I would suggest you use system-config-firewall or system-config-firewall-tui . There is a section with "custom rules" which will do this for you.

If you want to do this kind of things manually you have to insert the rule before the "ACCEPT" for tcp dpt:http . The easiest way is: iptables -I INPUT 1 -s xxx.xxx.xxx.xxx -j DROP

( Insert at position 1 , instead of Append )

share|improve this answer
    
Aren't most linux servers headless? –  TheLQ Feb 6 '12 at 16:19

Your first iptables rule allows the very traffic you are trying to block.

1    ACCEPT     all  --  anywhere             anywhere            

Order matters.

share|improve this answer
2  
Its generally good practice to use -I INPUT instead of -A INPUT for just this reason. Of course you should know when to use each, but the better habit would be -I. –  Patrick Feb 6 '12 at 5:05

Since your problem was already solved, let me add an aside: your INPUT chain already has the policy set to ACCEPT. The rule to ACCEPT all traffic is not only messing up your firewall, it is also redundant while working differently than the policy (depending on where in the chain the ACCEPTing rule is placed) - which makes it both useless and difficul to debug. Don't cover the same thing twice in your firewall.

share|improve this answer
    
Wish I could vote this twice. I've seen many people get confused by completely discounting what the policy is. –  pboin Feb 6 '12 at 13:00

You can see that IP, because you have rule for accepting RELATED and ESTABLISHED sessions:

3    ACCEPT     all  --  anywhere             anywhere state RELATED,ESTABLISHED

You need kill connection from blocked IP va tcpkill and that IP will not connect anymore :)

share|improve this answer
    
Right track, wrong answer - as per @dmourati's answer, the first "accept absolutely everything" basically invalidates the entire rest of the ruleset. –  Shadur Feb 6 '12 at 9:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.