Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Specifically talking about an Ubuntu 10.04 LTS server (Lucid Lynx), although its probably applicable to other Linux versions.

I was trawling through the logs for a few websites, doing some spring cleaning so to speak and noticed a few IP addresses that have been acting dodgy so I wanted to add them to the blacklist.

Basically I got playing around with IPtables, the blacklist of IP's is just a text file. I then created a shell script to loop through the text file and block each IP address in IPtables.

This worked fine when the shell script was run manually. But obviously I wanted it to run automatically at start up, for whenever the server may be rebooted. So I included the shell script into

/etc/network/if-pre-up.d/iptables

So it now looks like

#!/bin/sh 
/sbin/iptables-restore < /etc/iptables.up.rules
sh /etc/addBlacklist.sh

So I rebooted the server and the blacklist rules where applied, but it seems like they have been applied multiple times. As in duplicate lines appearing when iptables -L is run.

Just wondering if anyone would know the reason for this?

I suppose it doesn't really matter in the grand scheme of things but I'm curious.

** UPDATE ** Content of files as requested.

iptables.up.rules

*filter

# Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT


#  Accepts all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT


#  Allows all outbound traffic
#  You can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT


# Allows HTTP and HTTPS connections from anywhere
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT


#  Allows SSH connections
-A INPUT -p tcp -m state --state NEW --dport 6000 -j ACCEPT


# Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT


# log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7


# Reject all other inbound - default deny unless explicitly allowed policy
-A INPUT -j REJECT
-A FORWARD -j REJECT

COMMIT

addBlacklist.sh

IPTABLES="/sbin/iptables"
BLOCKED_IP="/etc/IPBlacklist.txt"
if [ -f $BLOCKED_IP ]; then
     while read BLOCKED; do
     echo $BLOCKED
            $IPTABLES -A INPUT -s $BLOCKED -j DROP
            $IPTABLES -A OUTPUT -d $BLOCKED -j DROP
    done < $BLOCKED_IP
 fi

IPBlacklist.txt

62.28.144.150
89.107.227.210
64.15.156.151
58.218.199.147
58.218.199.227
118.218.199.147
121.173.121.26
187.45.180.205
95.168.183.186
76.164.173.166
183.82.53.230
65.52.108.200
173.3.14.187
61.218.36.21
84.45.113.100
86.177.159.153
195.28.88.162
84.45.113.100
share|improve this question
    
How did you execute the script that adds iptables rules? Did you execute it multiple times or did create a list which contains duplicate rules? –  Khaled Jan 8 '13 at 13:53
    
What's the content of /etc/iptables.up.rules and /etc/addBlacklist.sh? –  ott-- Jan 8 '13 at 14:03
    
When i executed it manually, each IP address only appeared once when running iptables -L. I then setup the /etc/network/if-pre-up.d/iptables, so that it included the sh /etc/addBlacklist.sh line. Then rebooted the server, at which point iptables -L showed duplicate entries? Which would make sense if the iptable rules were persistent but i was sure that they were wiped after a reboot. –  cosmicsafari Jan 8 '13 at 14:07
    
84.45.113.100 appears twice in IPBlacklist.txt. Sorting the list is a handy way to find duplicates. sort IPBlacklist.txt | uniq will remove any. –  Ladadadada Jan 8 '13 at 14:31
    
Do the duplicates for each IP appear next to each other or do you get a full set of IP rules followed by another full set of IP rules? –  Ladadadada Jan 8 '13 at 14:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.