Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Specifically talking about an Ubuntu 10.04 LTS server (Lucid Lynx), although its probably applicable to other Linux versions.

I was trawling through the logs for a few websites, doing some spring cleaning so to speak and noticed a few IP addresses that have been acting dodgy so I wanted to add them to the blacklist.

Basically I got playing around with IPtables, the blacklist of IP's is just a text file. I then created a shell script to loop through the text file and block each IP address in IPtables.

This worked fine when the shell script was run manually. But obviously I wanted it to run automatically at start up, for whenever the server may be rebooted. So I included the shell script into


So it now looks like

/sbin/iptables-restore < /etc/iptables.up.rules
sh /etc/

So I rebooted the server and the blacklist rules where applied, but it seems like they have been applied multiple times. As in duplicate lines appearing when iptables -L is run.

Just wondering if anyone would know the reason for this?

I suppose it doesn't really matter in the grand scheme of things but I'm curious.

** UPDATE ** Content of files as requested.



# Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d -j REJECT

#  Accepts all established inbound connections

#  Allows all outbound traffic
#  You can modify this to only allow certain traffic

# Allows HTTP and HTTPS connections from anywhere
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

#  Allows SSH connections
-A INPUT -p tcp -m state --state NEW --dport 6000 -j ACCEPT

# Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

# log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

# Reject all other inbound - default deny unless explicitly allowed policy


if [ -f $BLOCKED_IP ]; then
     while read BLOCKED; do
     echo $BLOCKED
            $IPTABLES -A INPUT -s $BLOCKED -j DROP
    done < $BLOCKED_IP

share|improve this question
How did you execute the script that adds iptables rules? Did you execute it multiple times or did create a list which contains duplicate rules? – Khaled Jan 8 '13 at 13:53
What's the content of /etc/iptables.up.rules and /etc/ – ott-- Jan 8 '13 at 14:03
When i executed it manually, each IP address only appeared once when running iptables -L. I then setup the /etc/network/if-pre-up.d/iptables, so that it included the sh /etc/ line. Then rebooted the server, at which point iptables -L showed duplicate entries? Which would make sense if the iptable rules were persistent but i was sure that they were wiped after a reboot. – cosmicsafari Jan 8 '13 at 14:07 appears twice in IPBlacklist.txt. Sorting the list is a handy way to find duplicates. sort IPBlacklist.txt | uniq will remove any. – Ladadadada Jan 8 '13 at 14:31
Do the duplicates for each IP appear next to each other or do you get a full set of IP rules followed by another full set of IP rules? – Ladadadada Jan 8 '13 at 14:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.