Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

CentOS 6.2 - vsftpd running

The persone behind 95.76.44.67 scans my ftp server everyday and i blocked him from iptables but checking vsftpd.log i see that he can still connect to vsftpd and i dont know why.

Here is my iptables output :

Chain INPUT (policy ACCEPT 223K packets, 34M bytes)
num   pkts bytes target     prot opt in     out     source               destination
1    18709 1370K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:512
2    43135 2175K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:21
3     143K  181M ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpts:62222:63333
4    68342   94M ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:25
5        1    44 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:53
6     254K   30M ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:3306
7        8   472 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:465
8     103K  140M ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:587
9     122K 7662K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:995
10    7486 1039K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:443
11    1201  114K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:8080
12    277K  595M ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
13       0     0 DROP       all  --  *      *       70.148.48.200        0.0.0.0/0
14    2015 81956 DROP       all  --  *      *       95.76.44.67          0.0.0.0/0
15       0     0 DROP       all  --  *      *       95.76.133.243        0.0.0.0/0
16       0     0 DROP       all  --  *      *       95.76.186.81         0.0.0.0/0
17       0     0 DROP       all  --  *      *       95.76.102.135        0.0.0.0/0
18       0     0 DROP       all  --  *      *       118.69.198.201       0.0.0.0/0
19       0     0 DROP       all  --  *      *       69.94.28.73          0.0.0.0/0
20       0     0 DROP       all  --  *      *       218.60.44.132        0.0.0.0/0
21       0     0 DROP       all  --  *      *       80.232.232.9         0.0.0.0/0
22       0     0 DROP       all  --  *      *       61.184.196.122       0.0.0.0/0
23       0     0 DROP       all  --  *      *       61.51.18.235         0.0.0.0/0
24       0     0 DROP       all  --  *      *       218.29.115.152       0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 1287K packets, 1178M bytes)
num   pkts bytes target     prot opt in     out     source               destination

Anything I can do to block him from connecting to vsftpd ?

share|improve this question

4 Answers 4

up vote 8 down vote accepted

Iptables works on a first rule to match wins so the

2    43135 2175K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:21

allowing connections on port 21 wins over the

14    2015 81956 DROP       all  --  *      *       95.76.44.67          0.0.0.0/0

as, for FTP connections it's never actioned.

Put the DROP for 95.76.44.67 before the accept for FTP. You probably want to change the command that implements this to -I ... rather than -A ...

share|improve this answer
    
Thanks alot for all the help. –  Ionut Jul 20 '12 at 9:00

The DROP rules need to come before the rule accepting the FTP connections on port 21.

iptables works on a first hit mechanism.

share|improve this answer

For a perfect IPTABLE policy, first DROP everything and open the necessary ports. In your case put the DROP rule before ACCEPT. It should work.

Good Day.

share|improve this answer

Slightly tangential to the question, but consider an iptables frontend like Shorewall (http://shorewall.net/). You can add rules in a more intuitive way, and you can drop a given address dynamically by just running "shorewall drop 1.2.3.4".

Also consider fail2ban (http://www.fail2ban.org/), which can scan your logs and automatically drop certain IP addresses. It works with raw iptables, or with Shorewall.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.