I'm running a Centos 6.0 server, with Apache 2/MySQL. I've got iptables running. I followed these steps tonight to block all traffic from an IP using iptables:
iptables -A INPUT -s xxx.xxx.xxx.xxx -j DROP
iptables -A OUTPUT -d xxx.xxx.xxx.xxx -j DROP
service iptables save
service iptables restart
But I'm still seeing hits from this IP in my Apache access logs constantly, even after I restart Apache. iptables is definitely running and it's definitely the right IP address.
These are the rest of my iptables entries:
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT all -- anywhere anywhere
2 REJECT all -- anywhere loopback/8 reject-with icmp-port-unreachable
3 ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
4 ACCEPT tcp -- anywhere anywhere tcp dpt:http
5 ACCEPT tcp -- anywhere anywhere tcp dpt:https
6 ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:30000
7 ACCEPT icmp -- anywhere anywhere icmp echo-request
8 REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT)
num target prot opt source destination
1 REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT all -- anywhere anywhere
What am I missing?