2

I am running a server which needs UDP ports 1000:11000 opened, as well as TCP 10011 and 30033 open to function.

I have a set of iptables rules set to allow SSH and those ports, and intentionally left out 2010 as I am getting attacked on that port. The server does not block the incoming IP even when told to do so. The IP that needs to be denied is: 194.97.114.3.

My iptables script:

service iptables restart
iptables --flush

iptables -P INPUT DROP

iptables -A INPUT -i lo -p all -j ACCEPT

iptables -A INPUT -p tcp -m tcp --dport 10011 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 30033 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT


iptables -A INPUT -s 194.97.114.3 -j DROP
iptables -I INPUT -p udp --destination-port 1000:2009 -j ACCEPT
iptables -I INPUT -p udp --destination-port 2011:11000 -j ACCEPT
service iptables save

With that, 194.97.114.3 is still able to connect on port 2010. Please help me.

EDIT, iptables -L -v -N output:

Chain INPUT (policy DROP 2833 packets, 412K bytes)
 pkts bytes target     prot opt in     out     source               destination
 305K   26M ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpts:2011:11000
 2910  128K ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpts:1000:2009
  145 19881 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
  303 17915 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:10011
   41  1816 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:30033
  393 28420 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22
    6   216 DROP       all  --  *      *       194.97.114.3         0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 415K packets, 37M bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22

Chain RH-Firewall-1-INPUT (0 references)
 pkts bytes target     prot opt in     out     source               destination
  • 1
    iptables -v -L -n? – quanta Aug 4 '12 at 2:29
1

You can try follow me

echo > /etc/sysconfig/iptables
service iptables restart
iptables -I INPUT -p tcp -m state --state NEW -m multiport ! --dports 30033,10011,22 -j DROP
iptables -I INPUT -p udp -m multiport --dports 1000:2009,2011:11000 -j ACCEPT
iptables -I INPUT -p udp -m multiport -s 194.97.114.3 --dports 1000:2009,2011:11000 -j DROP
  • I did the above commands, but that IP is still able to connect to the server on port 2010. – Collin Biedenkapp Aug 4 '12 at 3:01
  • I was just re-reading the logs and realized that the server is connecting to that IP, not being connected to. That IP tables rules are correct, thank you all. I need more sleep. That would explain why my bans weren't working! – Collin Biedenkapp Aug 4 '12 at 4:29
  • I see your rule can block IP you want, output: 6 216 DROP all -- * * 194.97.114.3 0.0.0.0/0 – tquang Aug 4 '12 at 4:43
3

Move your DROP line to before the ACCEPT lines.

  • iptables, order matters. – dmourati Aug 4 '12 at 3:57
  • I did, that still is allowing the IP to connect. – Collin Biedenkapp Aug 4 '12 at 4:00
  • 1
    @CollinBiedenkapp: Then you did it wrong. – womble Aug 4 '12 at 5:27
  • @CollinBiedenkapp, the config you posted clearly shows the DROP listed after the ACCEPTs. Quite simply, the DROP line would not get executed for a port 22 access because you've already told it to let everyone through. – John Gardeniers Aug 5 '12 at 1:02
  • I'm beginning to see how sensitive iptables is to order. I didn't realize that at first. I'm a Windows user, where everything is idiot-proof. – Collin Biedenkapp Aug 5 '12 at 5:16

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.