Blocking certain IPs with iptables

thinksincode · 12-21-2004, 09:49 AM

Hi all,

I'm trying to block an address/range of addresses from connecting to my server - web, SSH, whatever. So I tried creating an iptables rule. To test it, I first blocked access from another machine I can log in to. But after adding the rule, I still can connect from that machine. Is there anything wrong with this rule?

iptables -A INPUT -p tcp -d $(INET_IP) -s 129.63.8.2 -j DROP

I would assume that by omitting the --dport argument it would block all ports?

Butt-Ugly · 12-21-2004, 10:00 AM

You may already have a rule that accepts this IP, chains are processed in the order that their rules appear.

Try something simple to start with..

Code:

iptables -I INPUT -s 129.63.8.2 -j DROP

This is (-I) inserted as the first rule in the input chain, so will therefore be processed first.

Here's some concepts for beginners.. http://www.brennan.id.au/06-Firewall_Concepts.html

Miles.

maxut · 12-21-2004, 10:27 AM

iptables applies rules in order. fisrt rule is applied firstly. so if the first rule blocks network traffic, everything will be blocked. it doesnt matter what other rules says.
i prefer DROP as default policy for INPUT chain, then open neccessary ports or allow certain networks. this is a good idea. so other possibilities will be blocked by the default. it will also be easy to open a ports.

Code:

iptables -F INPUT
iptables -P INPUT DROP
iptables -A INPUT -i lo -j ACCPET
iptables -A INPUT -i $local_interface -s $local_net -j ACCEPT
iptables -A INPUT -p tcp -m mulitport --dport $allowed_port1,$allowed_port2,$allowed_port(x) -j ACCEPT

good luck.