6

I'm running a Centos 6.0 server, with Apache 2/MySQL. I've got iptables running. I followed these steps tonight to block all traffic from an IP using iptables:

iptables -A INPUT -s xxx.xxx.xxx.xxx -j DROP
iptables -A OUTPUT -d xxx.xxx.xxx.xxx -j DROP
service iptables save
service iptables restart

But I'm still seeing hits from this IP in my Apache access logs constantly, even after I restart Apache. iptables is definitely running and it's definitely the right IP address.

These are the rest of my iptables entries:

Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     all  --  anywhere             anywhere            
2    REJECT     all  --  anywhere             loopback/8          reject-with icmp-port-unreachable 
3    ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
4    ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http 
5    ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https 
6    ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:30000 
7    ACCEPT     icmp --  anywhere             anywhere            icmp echo-request 
8    REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         
1    REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     all  --  anywhere             anywhere

What am I missing?

4 Answers 4

7

At first I would suggest you use system-config-firewall or system-config-firewall-tui . There is a section with "custom rules" which will do this for you.

If you want to do this kind of things manually you have to insert the rule before the "ACCEPT" for tcp dpt:http . The easiest way is: iptables -I INPUT 1 -s xxx.xxx.xxx.xxx -j DROP

( Insert at position 1 , instead of Append )

1
  • Aren't most linux servers headless?
    – TheLQ
    Feb 6, 2012 at 16:19
19

Your first iptables rule allows the very traffic you are trying to block.

1    ACCEPT     all  --  anywhere             anywhere            

Order matters.

1
  • 2
    Its generally good practice to use -I INPUT instead of -A INPUT for just this reason. Of course you should know when to use each, but the better habit would be -I.
    – phemmer
    Feb 6, 2012 at 5:05
4

Since your problem was already solved, let me add an aside: your INPUT chain already has the policy set to ACCEPT. The rule to ACCEPT all traffic is not only messing up your firewall, it is also redundant while working differently than the policy (depending on where in the chain the ACCEPTing rule is placed) - which makes it both useless and difficul to debug. Don't cover the same thing twice in your firewall.

1
  • Wish I could vote this twice. I've seen many people get confused by completely discounting what the policy is.
    – pboin
    Feb 6, 2012 at 13:00
-1

You can see that IP, because you have rule for accepting RELATED and ESTABLISHED sessions:

3    ACCEPT     all  --  anywhere             anywhere state RELATED,ESTABLISHED

You need kill connection from blocked IP va tcpkill and that IP will not connect anymore :)

1
  • Right track, wrong answer - as per @dmourati's answer, the first "accept absolutely everything" basically invalidates the entire rest of the ruleset. Feb 6, 2012 at 9:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .