How do I list IP addresses blocked by iptables?

Question

To prevent brute force attacks against ssh I've added some iptables rules (below). The question is: How can I list the blocked IP addresses?

(1)
iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 8 --rttl --name SSH -j DROP

Answer 1

One option would be to log any of your dropped packets with a rule like:

iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 8 --rttl -j LOG --log-prefix "FW_DROPPED: "

Insert that immediately before the DROP rule. Then, you can grep the syslog file for anything with "FW_DROPPED" in it and the list of IPs will be there. The entries in the log file look something like this:

Jun  3 08:05:57 some-machine kernel: [15852451.420557] FW_DROPPED: IN=eth0 OUT= MAC=00:50:ba:4a:d9:e3:00:12:17:3a:e3:64:08:00 SRC=228.23.45.189 DST=192.168.1.1 LEN=48 TOS=0x00 PREC=0x00 TTL=106 ID=10941 PROTO=TCP SPT=58212 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0

So, snipping out what follows "SRC=" will show you the dropped IPs. Sort that, eliminating duplicates, and you'll have your list.

I've found the Iptables Tutorial to be the most useful documentation for iptables/netfilter.

Answer 2

You can find details under /proc/net/ipt_recent/SSH.

This article has more information.

Answer 3

Look at

/proc/net/ipt_recent/YOURNAME

where YOURNAME is the name you used with --name option in your iptables rule.

Answer 4

Here is a simple one liner:

$ iptables -L -n --line

Answer 5

What I do, for example for input address spoofing, is to define the chain SPOOF_REJECT:

iptables -N SPOOF_REJECT
iptables -A SPOOF_REJECT -j LOG --log-prefix "Input spoof detected: "
iptables -A SPOOF_REJECT -j REJECT

then to send packets to this chain if they are spoofed:

iptables -A INPUT -i $EXT_DEV1 -s $INT_NET -j SPOOF_REJECT
iptables -A INPUT -i $EXT_DEV2 -s $INT_NET -j SPOOF_REJECT

You could do something like this for each category of packets you drop or reject to get a line in the syslog to look for, then periodically grep, cut, sort, to get just the IP addresses from these log lines.

The benefit to using individual chains for each category is that your configuration gets more straightforward and it gets easier to read your iptables configuration. As you add more and more rules, you'll be glad that you used individual chains for specific different actions.

Answer 6

"The question is: How can I list the blocked IP addresses?"

Create a BANNED chain:

iptables -N BANNED
iptables -F BANNED

Create a logging chain:

iptables -N BANNEDLOG
iptables -F BANNEDLOG
iptables -A BANNEDLOG -j LOG --log-prefix "BANNED:" --log-level 6
iptables -A BANNEDLOG -j DROP

Add jump to banned chain in the INPUT chain before most other rules

...
iptables -A INPUT -j BANNED
...

Now add ipaddresses to the banned chain:

flock -w 5 /var/lock/iptables -c 'iptables -A BANNED -s 140.130.20.202/32 -i eth0 -m comment --comment "2012-03-19 23:49:33 accesslog" -j BANNEDLOG'
etc...

You can also use it like a database with the comment options, so you can know when and why etc. flock is important when iptables is being frequently updated by many processes - it appears that iptables doesn't have any locking built in to it.

To view the banned addresses and rules in the banned chain:

iptables -S BANNED

To view just sorted unique ipaddresses:

iptables -S BANNED | egrep -o '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | sort -u

I have a number of daemons running on my servers checking the syslog files and weblogs, so if anything nasty is being attempted by anyone, their address is automatically banned for a few days, depending on type and severity and number of previous attacks. The info is logged into a mysql database, and periodically expired. The addresses are also distributed to every other machine in the cluster over mysql replication so they are also protected and keep in sync. My software also looks up the owner of the network and mails a complaint to the ISP.

After 10 years of work, I hope to make it available for everyone to use soon. I currently have about 1.5 million ip address histories and hundreds of thousands of mail and ssh attacks reported, helping to clean the net. If more would use it then I hope it would have more impact.