0

I am trying to block one IP with iptables in my Ubuntu server 12.04.

The foreign IP is 117.16.18.95.dyna. You can take a look at the next image:

enter image description here

I have added this ip to iptables with the next command:

sudo iptables -A INPUT -s 117.16.18.95 -p tcp -j DROP
sudo service iptables-persistent save
sudo service iptables-persistent restart

However, when i run again the command netstat -tap, this IP is not blocked.

How can I remove/block/delete this IP from my Ubuntu server?

  • 1
    add a -n to the netstat command and confirm the IP address is correct. – Iain Jan 5 '16 at 11:35
  • 1
    Please use Markdown and/or the formatting options in the edit menu to properly type-set your posts to improve their readability. Also use cut-and-paste for posting console output and format it as "code" rather than posting screenshots. That improves readability, attracts better answers and allows indexing by search engines, which may help people with similar questions. – HBruijn Jan 5 '16 at 12:24
  • If you want the -p option to netstat to actually work, you must run it with sudo. – Michael Hampton Jan 5 '16 at 16:41
2

IP adresses contains only digits. So '117.16.18.95.dyna' is definitely not IP, it is FQDN. I suspect that real ip is reversed. So, try to block 95.18.16.117
Or just to ensure try netstat with '-n' arg, it will prevent IPs from resolving to FQDNs

3

iptables -A will append the rule to the end of your rule set. If there is any rule before that IP allowing these connections somehow, the rule will never be hit, since the order of processing in iptable rules are up to down. Furthermore. There may also be rules like stateful iptable rules (eg RELATED,ESTABLISHED) which will allow connections if the session was initiated by your host.

Check with iptables -L -v -n and read the output. There are counters there which can tell if your rule has ever been in effect.

Also, you can append your rule to the top of the INPUT chain instead of to the bottom by replacing the -A (append) with -I (insert).

  • 1
    That's a good answer. When you say counter, you mean pkts ? – Houman Apr 15 at 10:49
  • indeed yes pkts! – Petter H Apr 16 at 8:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.