Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Specifically talking about an Ubuntu 10.04 LTS server (Lucid Lynx), although its probably applicable to other Linux versions.

I was trawling through the logs for a few websites, doing some spring cleaning so to speak and noticed a few IP addresses that have been acting dodgy so I wanted to add them to the blacklist.

Basically I got playing around with IPtables, the blacklist of IP's is just a text file. I then created a shell script to loop through the text file and block each IP address in IPtables.

This worked fine when the shell script was run manually. But obviously I wanted it to run automatically at start up, for whenever the server may be rebooted. So I included the shell script into

/etc/network/if-pre-up.d/iptables

So it now looks like

#!/bin/sh 
/sbin/iptables-restore < /etc/iptables.up.rules
sh /etc/addBlacklist.sh

So I rebooted the server and the blacklist rules where applied, but it seems like they have been applied multiple times. As in duplicate lines appearing when iptables -L is run.

Just wondering if anyone would know the reason for this?

I suppose it doesn't really matter in the grand scheme of things but I'm curious.

** UPDATE ** Content of files as requested.

iptables.up.rules

*filter

# Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT


#  Accepts all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT


#  Allows all outbound traffic
#  You can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT


# Allows HTTP and HTTPS connections from anywhere
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT


#  Allows SSH connections
-A INPUT -p tcp -m state --state NEW --dport 6000 -j ACCEPT


# Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT


# log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7


# Reject all other inbound - default deny unless explicitly allowed policy
-A INPUT -j REJECT
-A FORWARD -j REJECT

COMMIT

addBlacklist.sh

IPTABLES="/sbin/iptables"
BLOCKED_IP="/etc/IPBlacklist.txt"
if [ -f $BLOCKED_IP ]; then
     while read BLOCKED; do
     echo $BLOCKED
            $IPTABLES -A INPUT -s $BLOCKED -j DROP
            $IPTABLES -A OUTPUT -d $BLOCKED -j DROP
    done < $BLOCKED_IP
 fi

IPBlacklist.txt

62.28.144.150
89.107.227.210
64.15.156.151
58.218.199.147
58.218.199.227
118.218.199.147
121.173.121.26
187.45.180.205
95.168.183.186
76.164.173.166
183.82.53.230
65.52.108.200
173.3.14.187
61.218.36.21
84.45.113.100
86.177.159.153
195.28.88.162
84.45.113.100
share|improve this question
    
How did you execute the script that adds iptables rules? Did you execute it multiple times or did create a list which contains duplicate rules? – Khaled Jan 8 '13 at 13:53
    
What's the content of /etc/iptables.up.rules and /etc/addBlacklist.sh? – ott-- Jan 8 '13 at 14:03
    
When i executed it manually, each IP address only appeared once when running iptables -L. I then setup the /etc/network/if-pre-up.d/iptables, so that it included the sh /etc/addBlacklist.sh line. Then rebooted the server, at which point iptables -L showed duplicate entries? Which would make sense if the iptable rules were persistent but i was sure that they were wiped after a reboot. – cosmicsafari Jan 8 '13 at 14:07
    
84.45.113.100 appears twice in IPBlacklist.txt. Sorting the list is a handy way to find duplicates. sort IPBlacklist.txt | uniq will remove any. – Ladadadada Jan 8 '13 at 14:31
    
Do the duplicates for each IP appear next to each other or do you get a full set of IP rules followed by another full set of IP rules? – Ladadadada Jan 8 '13 at 14:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.