Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have following script, which I found somewhere in the Internet, and I modified it a little bit to suit my needs.

My question is: If I understood output of iptables-save my iptables rules are maderight, but I just want to make sure.

Here is my .sh file:

#!/bin/bash
ISO="af cn th vn in bd pk"

### Set PATH ###
IPT=/sbin/iptables
WGET=/usr/bin/wget
EGREP=/bin/egrep

### No editing below ###
SPAMLIST="countrydrop"
ZONEROOT="/root/iptables"
DLROOT="http://www.ipdeny.com/ipblocks/data/countries"

cleanOldRules(){
$IPT -F
$IPT -X
$IPT -t nat -F
$IPT -t nat -X
$IPT -t mangle -F
$IPT -t mangle -X
$IPT -P INPUT ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT
}

# create a dir
[ ! -d $ZONEROOT ] && /bin/mkdir -p $ZONEROOT

# clean old rules
cleanOldRules

# create a new iptables list
$IPT -N $SPAMLIST







for c  in $ISO
do
        # local zone file
        tDB=$ZONEROOT/$c.zone

        # get fresh zone file
        $WGET -O $tDB $DLROOT/$c.zone

        # country specific log message
        SPAMDROPMSG="$c Country Drop"

        # get
        BADIPS=$(egrep -v "^#|^$" $tDB)
        for ipblock in $BADIPS
        do
          # $IPT -A $SPAMLIST -s $ipblock -j LOG --log-prefix "$SPAMDROPMSG"
           $IPT -A $SPAMLIST -s $ipblock -j DROP
        done
        sleep 3
done


$IPT -I INPUT -j $SPAMLIST
$IPT -I OUTPUT -j $SPAMLIST
$IPT -I FORWARD -j $SPAMLIST

#My part
$IPT -P INPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
$IPT -A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
$IPT -A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
$IPT -A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
$IPT -A INPUT -s 188.92.161.49/32 -j ACCEPT
$IPT -A INPUT -s 127.0.0.1/32 -p tcp -m tcp --dport 25 -j ACCEPT
$IPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
$IPT -A INPUT -s 188.92.163.198/32 -j ACCEPT
$IPT -A INPUT -p tcp -m tcp --dport 25 -j DROP
$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p icmp -j ACCEPT
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
$IPT -A FORWARD -j REJECT --reject-with icmp-host-prohibited
$IPT -A INPUT -j REJECT --reject-with icmp-host-prohibited


exit 0

And output of iptables save

# Generated by iptables-save v1.4.10 on Thu May  9 17:00:59 2013
*mangle
:PREROUTING ACCEPT [128952:24289058]
:INPUT ACCEPT [128944:24288514]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [180927:208852344]
:POSTROUTING ACCEPT [180927:208852344]
COMMIT
# Completed on Thu May  9 17:00:59 2013
# Generated by iptables-save v1.4.10 on Thu May  9 17:00:59 2013
*nat
:PREROUTING ACCEPT [3169:170149]
:INPUT ACCEPT [3118:164866]
:OUTPUT ACCEPT [909:54321]
:POSTROUTING ACCEPT [909:54321]
COMMIT
# Completed on Thu May  9 17:00:59 2013
# Generated by iptables-save v1.4.10 on Thu May  9 17:00:59 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [134106:154955595]
:countrydrop - [0:0]
-A INPUT -j countrydrop
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -s 127.0.0.1/32 -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j countrydrop
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A OUTPUT -j countrydrop
-A countrydrop -s 202.56.176.0/20 -j DROP
-A countrydrop -s 202.86.16.0/20 -j DROP
-A countrydrop -s 203.174.27.0/24 -j DROP
-A countrydrop -s 203.215.32.0/20 -j DROP
-A countrydrop -s 210.80.0.0/19 -j DROP
-A countrydrop -s 210.80.32.0/19 -j DROP
-A countrydrop -s 91.109.216.0/21 -j DROP
-A countrydrop -s 193.201.151.64/26 -j DROP
-A countrydrop -s 192.124.154.0/24 -j DROP

If I understood first of all traffice is directed to countrydrop, and then to my rules.

Am I right?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Yes, the command

$IPT -I INPUT -j $SPAMLIST

will insert a rule at the start of the INPUT chain that causes all packets to be sent to the countrydrop chain. You can see this in the iptables-save output as

-A INPUT -j countrydrop

You should be able to see this in your 'live' rules too

iptables -L INPUT
Chain INPUT (policy DROP)
target       prot     opt     source               destination
countrydrop  all      --      anywhere             anywhere
.
.
.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.