Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running a server which needs UDP ports 1000:11000 opened, as well as TCP 10011 and 30033 open to function.

I have a set of iptables rules set to allow SSH and those ports, and intentionally left out 2010 as I am getting attacked on that port. The server does not block the incoming IP even when told to do so. The IP that needs to be denied is: 194.97.114.3.

My iptables script:

service iptables restart
iptables --flush

iptables -P INPUT DROP

iptables -A INPUT -i lo -p all -j ACCEPT

iptables -A INPUT -p tcp -m tcp --dport 10011 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 30033 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT


iptables -A INPUT -s 194.97.114.3 -j DROP
iptables -I INPUT -p udp --destination-port 1000:2009 -j ACCEPT
iptables -I INPUT -p udp --destination-port 2011:11000 -j ACCEPT
service iptables save

With that, 194.97.114.3 is still able to connect on port 2010. Please help me.

EDIT, iptables -L -v -N output:

Chain INPUT (policy DROP 2833 packets, 412K bytes)
 pkts bytes target     prot opt in     out     source               destination
 305K   26M ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpts:2011:11000
 2910  128K ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpts:1000:2009
  145 19881 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
  303 17915 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:10011
   41  1816 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:30033
  393 28420 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22
    6   216 DROP       all  --  *      *       194.97.114.3         0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 415K packets, 37M bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22

Chain RH-Firewall-1-INPUT (0 references)
 pkts bytes target     prot opt in     out     source               destination
share|improve this question
1  
iptables -v -L -n? –  quanta Aug 4 '12 at 2:29
add comment

2 Answers 2

up vote 1 down vote accepted

You can try follow me

echo > /etc/sysconfig/iptables
service iptables restart
iptables -I INPUT -p tcp -m state --state NEW -m multiport ! --dports 30033,10011,22 -j DROP
iptables -I INPUT -p udp -m multiport --dports 1000:2009,2011:11000 -j ACCEPT
iptables -I INPUT -p udp -m multiport -s 194.97.114.3 --dports 1000:2009,2011:11000 -j DROP
share|improve this answer
    
I did the above commands, but that IP is still able to connect to the server on port 2010. –  Collin Biedenkapp Aug 4 '12 at 3:01
    
I was just re-reading the logs and realized that the server is connecting to that IP, not being connected to. That IP tables rules are correct, thank you all. I need more sleep. That would explain why my bans weren't working! –  Collin Biedenkapp Aug 4 '12 at 4:29
    
I see your rule can block IP you want, output: 6 216 DROP all -- * * 194.97.114.3 0.0.0.0/0 –  tquang Aug 4 '12 at 4:43
add comment

Move your DROP line to before the ACCEPT lines.

share|improve this answer
    
iptables, order matters. –  dmourati Aug 4 '12 at 3:57
    
I did, that still is allowing the IP to connect. –  Collin Biedenkapp Aug 4 '12 at 4:00
1  
@CollinBiedenkapp: Then you did it wrong. –  womble Aug 4 '12 at 5:27
    
@CollinBiedenkapp, the config you posted clearly shows the DROP listed after the ACCEPTs. Quite simply, the DROP line would not get executed for a port 22 access because you've already told it to let everyone through. –  John Gardeniers Aug 5 '12 at 1:02
    
I'm beginning to see how sensitive iptables is to order. I didn't realize that at first. I'm a Windows user, where everything is idiot-proof. –  Collin Biedenkapp Aug 5 '12 at 5:16
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.