I'm seeing brute force web login attempts from 10.19.0.222 My iptables contains:
DROP all -- anywhere anywhere match-set manual src
ipset test manual 10.19.0.222 confirms the address is in the set, but I continue to see the web login attempts from that address.
My iptables/ipset configuration is working perfectly for the many others addresses in the set, but seems ineffective with this 10. address.
Why is this?
And I thought 10. was reserved for private subnets. Why am I even seeing this address?
I have 3 interfaces:
eth0: inet addr:220.127.116.11 Bcast:18.104.22.168 Mask:255.255.255.0 lo: inet addr:127.0.0.1 Mask:255.0.0.0 tun0: inet addr:10.9.0.1 P-t-P:10.9.0.2 Mask:255.255.255.255
How can I determine which interface 10.19.0.222 came in on?