I'm seeing brute force web login attempts from My iptables contains:

DROP all  --  anywhere anywhere match-set manual src

ipset test manual confirms the address is in the set, but I continue to see the web login attempts from that address.

My iptables/ipset configuration is working perfectly for the many others addresses in the set, but seems ineffective with this 10. address.

Why is this?

And I thought 10. was reserved for private subnets. Why am I even seeing this address?

I have 3 interfaces:

eth0: inet addr:  Bcast:  Mask:
lo: inet addr:  Mask:
tun0: inet addr:  P-t-P:  Mask:

How can I determine which interface came in on?

  • 1
    are you sure it is not your address? – Dusan Bajic Oct 22 '15 at 15:12

It looks like it is from your LAN. Isn't it IP of your web server? subnet is reserved for private using and is not routed on Internet at all (routers should drop packets with this IPs going to public Internet).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.