I'm running 2 cPanel servers with ConfigServer Security & Firewall plugin. One of the functions of the plugin is to block via iptables (temporarily and/or permanently) IPs which fail various authentications (POP3/IMAP, SMTP, FTP, webmail, mod_security and such).

Now, i'd like to push those IP blocks to the border router to drop packets as soon as possible (and doing so protecting the other machines on the network).

Keep in mind that after N failed logins IP is blocked for 5 minutes, then re-allowed. If multiple bans occours in an hour IP is blocked permanently and should be unlocked "by hand". So I need a near realtime solution.

What I'm looking for is a better way than firing some cronjobs both on cPanels and border router to:

  • dump the rules to file
  • transfer the file to border router (via scp/sftp)
  • load the rules from the file in the border router

I'm aware that I will need some scripts to parse and modify the rules as cPanels have one ethernet interface and some aliases while border router has two ehternet interfaces and some loopbacks.

All machines involved use Linux.

EDIT as per @pjmorse comment.

The plugin consists of a bunch of perl and config files. The part I'm intrested in is a process which scans logfiles (lfd) and installs iptables rules (and sends an alert email). Fact is, it upgrades quite often (one or two times a week) and itself is >7000 lines of perl so I'm not comfortable on tampering with it.

  • I'm not familiar with this plugin, but I can mentally sketch out a solution for this, and I bet other users could too. One important piece of information: can the plugin be hacked or hooked to run an external script when it adds an IP to iptables? – pjmorse Mar 29 '12 at 14:28
  • @pjmorse i don't know but i can check it... – Mr Shunz Mar 29 '12 at 14:51

One solution that would provide a realtime 'transfer' would be to replace iptables with a script that calls iptables on the router.

  1. generate an ssh key pair, and authorize the key to log into root on the gateway host
  2. create /path/to/override/iptables as a script which runs
    ssh root@routerhost iptables "$@"
  3. In the startup script which starts your web server, set PATH="/path/to/override:$PATH"

Now whenever the plugin goes looking for iptables it'll find the one in /path/to/override since it was specified first in $PATH. It'll run the script when passes all the arguments the script received to iptables on routerhost.
However if the plugin uses an absolute path to iptables, you will instead have to manually change the path in the plugin.

| improve this answer | |
  • Actually, this is a really nice solution. No need to change the PATH enviroment as I can configure the iptables path on the plugin so I can point it to my script! Didn't think of it! Actually the script will be slightly more complex because interfaces differs and also on the border router I need to put the rules on the FORWARD chain and not the INPUT chain, but nothing too complicated ;) – Mr Shunz Mar 30 '12 at 7:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.