0

i have iptables running on my centos 7 server and i'm looking to block bots i use this command

iptables -A INPUT -s 70.42.131.0/24 -j DROP;

this normally should block this range 70.42.131.0/24 however when i try to reach a website with my IP i cannot access to it and when i add ACCEPT tcp from everywhere the blocked ip can reach the website now i'm confused if i block a range should i remove ACCEPT from everywhere or i should i remove it or iptables depend on TABLE line number to take effect?

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:websm
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     gre  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     icmp --  anywhere             anywhere            
DROP       tcp  --  anywhere             static.76.1.16.24.clients.your-server.de  tcp dpt:http
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain
Improve this question
4
  • What do you mean by "reach a web site with my IP"? Which web site, which IP? What have web site and IP to do with this server? The INPUT chain does not block outgoing traffic. Yes, the order of the rules is significant. Rules are checked one after the other; when DROP, REJECT or ACCEPT are encountered, processing stops. By the way, I don't see any DROP rule in your INPUT chain, but you have one in the OUTPUT chain.
    – berndbausch
    Mar 23, 2021 at 23:50
  • i mean when i try to access to a website on this server its dropped because this server had apache server installed on it and normally it should work for my IP i just dropped the bot range only
    – Omer Stimpack
    Mar 24, 2021 at 10:49
  • The INPUT chain accepts https, but not http.
    – berndbausch
    Mar 24, 2021 at 13:45
  • it works for me by adding unwanted bots rule in OUTPUT with: iptables -A OUTPUT -s 99.80.0.0/15 -j DROP; normally it should be added in INPUT because it's incoming traffic. I tested with blocking my vpn and it works!
    – Omer Stimpack
    Mar 26, 2021 at 13:42

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .