1

If I add this line to my iptables:

-A INPUT -s /32 -i tcp -p tcp -m tcp --dport 22 -j DROP

I get the error:

iptables-restore v1.4.14: host/network' not found`

When running:

sudo iptables-restore /etc/network/iptables

Is there a problem with that line? If not, I will post the rest of the iptable configuration.

complete configuration:

*filter
:INPUT DROP [23:2584]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1161:105847]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT
# -A INPUT -s /32 -i tcp -p tcp -m tcp --dport 22 -j DROP
-A INPUT -s 192.168.0.10/24 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT

copied from here

1
  • 1
    I'm voting to close this question as off-topic because it is too narrowly focused to the OP's problem, and answers are unlikely to benefit future visitors.
    – womble
    Aug 22, 2015 at 21:07

3 Answers 3

3

There is a problem with that line, specifically the -s /32 portion. You have to define a host. For example:

-A INPUT -s 123.45.67.8/32 -i tcp -p tcp -m tcp --dport 22 -j DROP
2
  • Apparently that line is supposed to lock others out from using ssh. Is that ip/32 a single exception that will be allowed to ssh in? Aug 22, 2015 at 15:24
  • If you have a DROP statement at the end of the rules for that table then you only need to permit specific hosts. Update your question with your full iptables configuration (censor IPs as needed) and mention your need to filter SSH connections in the question.
    – Gene
    Aug 22, 2015 at 15:27
5

There's also a problem with -i tcp. That refers to traffic coming in the interface tcp; it's not syntactically invalid, but it won't match anything at all, because there isn't any such interface.

5
  • 2
    That was a very nice catch.
    – Gene
    Aug 22, 2015 at 15:25
  • 1
    So it seems my entire configuration is quite flakey in that case. I've added it to my question. Would you mind reviewing it? If you visit the link where I copied it from, the blogger tells us what each line is intended to do. Aug 22, 2015 at 15:26
  • We're not really in the business of hand-holding through the acquisition of elementary skills at SF, so I'm sorry, but I'm afraid I do mind. You should go away, buy a book on firewalling, read it, try it, then come back and ask questions that arise. You've had your specific question answered, so I further suggest you accept JennyD or Gene's answer.
    – MadHatter
    Aug 22, 2015 at 15:28
  • @MadHatter: I can't really verify if your answer is correct unless you can confirm that the full configuration is in fact wrong though Aug 22, 2015 at 15:36
  • My answer doesn't answer your question, so you shouldn't accept it; it was merely an additional note on something else that was wrong with your rule. As for verifying it, try man iptables and look for the -i flag. Both Jenny D and Gene have given complete and definitive answers to the question you originally asked, and one of them deserves to have their answer accepted. If you'd wanted your entire config sanity-checked, you should have asked that - so that we could vote to close the question.
    – MadHatter
    Aug 22, 2015 at 16:40
4

It contains a netmask without a host. -s /32 should probably be -s 127.0.0.1/32 or something.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .