5

As a test, I started a TorBrowser, got its IP, and banned it via this command on my VPS:

sudo iptables -A INPUT -s <IP address> -j DROP

I'm still able to surf pages hosted by my server from the TorBrowser. I've even double checked the HTTP access.log to make sure the IP is what I banned, and it is. What am I missing?

My iptables file that gets read in upon boot (via iptables-restore)

#  Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j REJECT

# IP bans
-A INPUT -s 42.121.24.80 -j DROP
-A INPUT -s 121.196.43.157 -j DROP
-A INPUT -s 192.30.85.135 -j DROP
-A INPUT -s 94.102.53.175 -j DROP

#  Accept all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#  Allow all outbound traffic - you can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT

#  Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT
-A INPUT -p tcp --dport 8080 -j ACCEPT

# Mail
-A INPUT -p tcp --dport 993 -j ACCEPT
-A INPUT -p tcp --dport 465 -j ACCEPT
-A INPUT -p tcp --dport 587 -j ACCEPT
-A INPUT -p tcp --dport 25 -j ACCEPT

# Minecraft
-A INPUT -p tcp --dport 25565 -j ACCEPT

#  Allow SSH connections
#
#  The -dport number should be the same port number you set in sshd_config
#
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

#  Allow ping
-A INPUT -p icmp -j ACCEPT

#  Log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

#  Drop all other inbound - default deny unless explicitly allowed policy
-A INPUT -j DROP
-A FORWARD -j DROP

COMMIT

And iptables -L output:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
REJECT     all  --  anywhere             127.0.0.0/8          reject-with icmp-port-unreachable
DROP       all  --  out524-80.mail.aliyun.com  anywhere            
DROP       all  --  ip196.hichina.com    anywhere            
DROP       all  --  192.30.85.135-IP-Static-VISPERAD.COM  anywhere            
DROP       all  --  tor-exit-nl1.privacyfoundation.dk  anywhere            
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http-alt
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:imaps
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssmtp
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:submission
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:smtp
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:25565
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
ACCEPT     icmp --  anywhere             anywhere            
LOG        all  --  anywhere             anywhere             limit: avg 5/min burst 5 LOG level debug prefix "iptables denied: "
DROP       all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
6
  • sudo iptables -L INPUT, order matters
    – dmourati
    May 14, 2013 at 2:23
  • @MichaelHampton I think you missed my point. I'm only using Tor to obtain a separate IP to test my iptables banning. I'm not actually planning on banning Tor. May 14, 2013 at 3:55
  • @dmourati Updated my post to include -L output. May 14, 2013 at 3:56
  • 1
    You would have to ban every Tor exit node to test it this way. The IP address you see on, e.g. check.torproject.org may not be the same as that when you visit your own site, since it may open a separate circuit which has a different exit node. May 14, 2013 at 3:58

2 Answers 2

7

dmourati asked for iptables -L INPUT for a reason, aka your current rules.
Before testing the torbrowser, you had the posted rules (or similar).
Now on the middle of it :

-A INPUT -p tcp --dport 80 -j ACCEPT

After that you executed

iptables -A INPUT -s <IP address> -j DROP

So your rule ended up AFTER you accepted all port 80 traffic, thus nothing to DROP since was already accepted.
You should have added the rule with

iptables -I INPUT -s <IP address> -j DROP
3
  • See my iptables file above. IP bans are listed first (I added my Tor IP there), and then port 80 is allowed afterwards. Still doesn't work. May 14, 2013 at 3:50
  • I edited my original post to include the -L output. May 14, 2013 at 3:56
  • Ah hell. Tor's IP was changing very quickly, as it turns out. I tried using my iPhone's IP and banned it in the iptables file, and it works fine. Though I didn't realize I had to use -I for insert. Will do that going forward, thanks! May 14, 2013 at 4:08
2

If you want to give priority to the drop command you need to insert (-I) it before the append (-A) command that allows port 80.

Order matters, try:

sudo iptables -I INPUT -s <IP address> -j DROP

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .