Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

After I do add the ip adresses that is attacking me, I do add this iptables -A INPUT -s 109.73.162.160 -j DROP and service iptables save.

The ip that I do add to my blocklist is lost within a few minuts, is there maybe an another way to block this ip adresses?

CentOS 4.0

share|improve this question

migrated from stackoverflow.com May 20 '12 at 8:59

This question came from our site for professional and enthusiast programmers.

    
That's weird. The rules don't disappear, may be you have another process/cronjob changing the rules. –  diegows May 19 '12 at 13:30
    
Thanks diegows there was another firewall installed named apf, i did uninstall it and my problem was solved –  Mustafa Önal May 19 '12 at 14:03
    
Consider migrating to a newer CentOS BTW. 4.0 is too old for today. It's actually EOL'ed: lists.centos.org/pipermail/centos-announce/2012-February/… –  FractalizeR May 20 '12 at 10:23
    
Perhaps: sudo apt-get install iptables-persistent –  jjwdesign Nov 20 '13 at 18:57
add comment

2 Answers

Obviously, this is not a programming question, but should go to serverfault.

Most likely, you have installed some other firewall script that reinitializes your firewall. Make sure you are only using one way of configuring your firewall, or they will interfere.

share|improve this answer
add comment

I am not directly familiar with iptables in CentOS 4.0 (hence these are general suggestions) but I think you can add the rules to the iptables configuration file in /etc/sysconfig/iptables in order that they are automatically loaded.

e.g. You will need to modify your iptables files to match something like this;

# cat /etc/sysconfig/iptables
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1494682:129394658]
:RH-Firewall-1-INPUT - [0:0]
#add your rules here
-A INPUT -s 109.73.162.160 -j DROP
#end of your rules here
-A INPUT -j RH-Firewall-1-INPUT 
-A FORWARD -j RH-Firewall-1-INPUT 
-A RH-Firewall-1-INPUT -i lo -j ACCEPT 
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT 
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT 
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited 
COMMIT

The 2nd issue appears to be that service iptables save is not persisting your rules correctly. Hence I would suggest pasting some of your configs in to your question for more help. e.g.

cat /etc/sysconfig/iptables
cat /etc/sysconfig/iptables-config

and whether you are running fail2ban, shorewall, ufw or some other package or service that would likely make changes to your configuration automatically.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.