1

I'm running a public Pi-hole on a Debian system. That works fine so far, but obviously one has to take care about malicious actors. Therefore I'm somewhat closely monitoring the client list and having a look for suspicious behaviour. If I find someone, I'll usually block the IP with iptables and people move on.

Quite often I have IPs from Digital Ocean hitting me hard, but not "too hard", so they could look like real user traffic without further investigation, only that they are doing lots of requests over the day in sum. After looking at their DNS requests, these are IPs that are monitoring/probing/searching various services with rather random URL patterns, possibly bruterforcing to find vulnerable systems. I'd like to discourage that use and have tried to ban those IPs. They come back with another IP of course, so I thought I'd try to ban the whole subnet.

That way normal users could still use the Pi-hole without any problems, but those VPS instances (or whatever) from Digital Ocean would be done for the moment. Obviously there are ways around that, too, but maybe they move on to someone else if I raise the hurdles. I'd be fine with that for the moment.

So I added the following rule to my iptables:

iptables -A INPUT -s 157.245.0.0/16 -j DROP

While iptables accepts that rule with no comment, I still see IPs from that subnet being served by the Pi-hole. That's at least what the Pi-hole logs/statistics tell me.

Is there something wrong with my iptables rule? Or are there better ways to create subnet-wide rules with iptables? I saw the range parameter but thought that defining the subnet scheme would be more intuitive and would like to use it therefore.

Thanks in advance!

edit: Here's the output of iptables-save: https://pastebin.com/Lm4zV1ii

4
  • 3
    There could possibly be a rule before the one you appended that allows the incoming connections. -A appends to the end of the table while -I inserts the rule at the top of the table, and iptables goes off the first match from the top. Nov 6, 2020 at 16:47
  • 1
    Please add output of iptables-save to the question. Nov 6, 2020 at 22:58
  • @TeroKilkanen I just added a pastebin with the output.
    – flomei
    Nov 7, 2020 at 20:24
  • @slightly_toasted Thanks, I'll look into that.
    – flomei
    Nov 7, 2020 at 20:24

1 Answer 1

2

With IPTables, rules are processed in the order they appear in the chains. Your system has Ubuntu ufw firewall management system set up, and it has installed a set of rules.

In your specific example, packets come to the system to INPUT chain. In the chain, on line 41, packets start to traverse ufw-before-logging-input chain. That chain contains several rules, until packets are passed to ufw-user-input chain on line 73.

In ufw-user-input, there is the rule to accept packets coming to ports 80 and 443 on lines 111 and 110 respectively.

Now, since your added rules are at the end of INPUT chain, it means that those rules are never reached, because packets are already accepted in ufw-user-input chain.

In your case, I recommend you to look up the official way of adding DROP rules in ufw, instead of bypassing it with separate iptables commands.

1
  • Thank you very much, that will help me a lot to understand better how this works!
    – flomei
    Nov 8, 2020 at 12:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .