Iptables wont block some IPs

Question

CentOS 6.2 - vsftpd running

The persone behind 95.76.44.67 scans my ftp server everyday and i blocked him from iptables but checking vsftpd.log i see that he can still connect to vsftpd and i dont know why.

Here is my iptables output :

Chain INPUT (policy ACCEPT 223K packets, 34M bytes)
num   pkts bytes target     prot opt in     out     source               destination
1    18709 1370K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:512
2    43135 2175K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:21
3     143K  181M ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpts:62222:63333
4    68342   94M ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:25
5        1    44 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:53
6     254K   30M ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:3306
7        8   472 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:465
8     103K  140M ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:587
9     122K 7662K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:995
10    7486 1039K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:443
11    1201  114K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:8080
12    277K  595M ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
13       0     0 DROP       all  --  *      *       70.148.48.200        0.0.0.0/0
14    2015 81956 DROP       all  --  *      *       95.76.44.67          0.0.0.0/0
15       0     0 DROP       all  --  *      *       95.76.133.243        0.0.0.0/0
16       0     0 DROP       all  --  *      *       95.76.186.81         0.0.0.0/0
17       0     0 DROP       all  --  *      *       95.76.102.135        0.0.0.0/0
18       0     0 DROP       all  --  *      *       118.69.198.201       0.0.0.0/0
19       0     0 DROP       all  --  *      *       69.94.28.73          0.0.0.0/0
20       0     0 DROP       all  --  *      *       218.60.44.132        0.0.0.0/0
21       0     0 DROP       all  --  *      *       80.232.232.9         0.0.0.0/0
22       0     0 DROP       all  --  *      *       61.184.196.122       0.0.0.0/0
23       0     0 DROP       all  --  *      *       61.51.18.235         0.0.0.0/0
24       0     0 DROP       all  --  *      *       218.29.115.152       0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 1287K packets, 1178M bytes)
num   pkts bytes target     prot opt in     out     source               destination

Anything I can do to block him from connecting to vsftpd ?

Answer 1

Iptables works on a first rule to match wins so the

2    43135 2175K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:21

allowing connections on port 21 wins over the

14    2015 81956 DROP       all  --  *      *       95.76.44.67          0.0.0.0/0

as, for FTP connections it's never actioned.

Put the DROP for 95.76.44.67 before the accept for FTP. You probably want to change the command that implements this to -I ... rather than -A ...

Answer 2

The DROP rules need to come before the rule accepting the FTP connections on port 21.

iptables works on a first hit mechanism.

Answer 3

For a perfect IPTABLE policy, first DROP everything and open the necessary ports. In your case put the DROP rule before ACCEPT. It should work.

Good Day.

Answer 4

Slightly tangential to the question, but consider an iptables frontend like Shorewall (http://shorewall.net/). You can add rules in a more intuitive way, and you can drop a given address dynamically by just running "shorewall drop 1.2.3.4".

Also consider fail2ban (http://www.fail2ban.org/), which can scan your logs and automatically drop certain IP addresses. It works with raw iptables, or with Shorewall.