0

I am trying to block one IP with iptables in my Ubuntu server 12.04.

The foreign IP is 117.16.18.95.dyna. You can take a look at the next image:

enter image description here

I have added this ip to iptables with the next command:

sudo iptables -A INPUT -s 117.16.18.95 -p tcp -j DROP
sudo service iptables-persistent save
sudo service iptables-persistent restart

However, when i run again the command netstat -tap, this IP is not blocked.

How can I remove/block/delete this IP from my Ubuntu server?

Improve this question
3
  • 1
    add a -n to the netstat command and confirm the IP address is correct.
    – user9517
    Jan 5, 2016 at 11:35
  • 1
    Please use Markdown and/or the formatting options in the edit menu to properly type-set your posts to improve their readability. Also use cut-and-paste for posting console output and format it as "code" rather than posting screenshots. That improves readability, attracts better answers and allows indexing by search engines, which may help people with similar questions.
    – HBruijn
    Jan 5, 2016 at 12:24
  • If you want the -p option to netstat to actually work, you must run it with sudo.
    – Michael Hampton
    Jan 5, 2016 at 16:41

2 Answers 2

Reset to default
2

IP adresses contains only digits. So '117.16.18.95.dyna' is definitely not IP, it is FQDN. I suspect that real ip is reversed. So, try to block 95.18.16.117
Or just to ensure try netstat with '-n' arg, it will prevent IPs from resolving to FQDNs

Improve this answer
0
3

iptables -A will append the rule to the end of your rule set. If there is any rule before that IP allowing these connections somehow, the rule will never be hit, since the order of processing in iptable rules are up to down. Furthermore. There may also be rules like stateful iptable rules (eg RELATED,ESTABLISHED) which will allow connections if the session was initiated by your host.

Check with iptables -L -v -n and read the output. There are counters there which can tell if your rule has ever been in effect.

Also, you can append your rule to the top of the INPUT chain instead of to the bottom by replacing the -A (append) with -I (insert).

Improve this answer
2
  • 1
    That's a good answer. When you say counter, you mean pkts ?
    – Houman
    Apr 15, 2019 at 10:49
  • indeed yes pkts!
    – Petter H
    Apr 16, 2019 at 8:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .