Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
#iptables -L -n -v
Chain INPUT (policy ACCEPT 42 packets, 3360 bytes)
pkts bytes target     prot opt in     out     source               destination
207  15586 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
0     0    ACCEPT     tcp  --  eth0   *       78.12.0.0/14         0.0.0.0/0            tcp dpt:22
0     0    ACCEPT     tcp  --  eth0   *       84.220.0.0/14        0.0.0.0/0            tcp dpt:22
119  7108  DROP       tcp  --  *      *       !78.12.47.44         0.0.0.0/0            tcp dpt:80
0     0    DROP       all  --  eth0   *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 143 packets, 16147 bytes)
pkts bytes target     prot opt in     out     source               destination

Standing to these firewall rules, Why in the auth.log I find

Jan 24 23:51:24 vps45276 sshd[1579]: Invalid user toto from 178.32.42.238
Jan 24 23:51:24 vps45276 sshd[1579]: Received disconnect from 178.32.42.238: 11:
Bye Bye [preauth]
Jan 25 00:10:09 vps45276 sshd[1608]: Invalid user serveur from 178.32.42.238
Jan 25 00:10:09 vps45276 sshd[1608]: Received disconnect from 178.32.42.238: 11:
Bye Bye [preauth]

What I made wrong with the rules?

share|improve this question
    
He is asking why, given these rules, there are still ssh connections getting through the firewall. That is the relationship between iptables and auth.log in this question. –  larsks Jan 25 at 1:45
    
@Zoredache Scroll sideways to see the rest of the rule. –  Michael Hampton Jan 25 at 4:45
    
Ah, thanks. Apparently iOS doesn't show horizontal scroll bars... :( –  Zoredache Jan 25 at 10:03

1 Answer 1

up vote 2 down vote accepted

You only DROPped traffic coming in on eth0. But the unwanted traffic is almost certainly coming in via a different interface. Remove that qualifier from the final DROP rule, and better yet set the INPUT table's policy to DROP.

share|improve this answer
    
agreed, I'd run a iptables -I INPUT 3 -p tcp --dport 22 -j LOG to confirm –  Petter H Jan 25 at 8:31
    
thank you good job, that was the solution. –  user1814173 Jan 25 at 12:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.