Re: IPs blocked still able to connect

[Michael Gale <michael.gale@utilitran.com>]

Hello,

	I did not mean you should be using -I for all your inserts .... when you load
you rules from a script ... a "-A" will work fine. But when adding a rules on
the fly later .. you most likely want to do a "-I" so it is at the top of the
list.

Example:

From script:

iptables -A INPUT -i eth0 -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -i eth0 -j DROP

Now you find that you want to block spam from mai.hotmail.com (1.1.1.1)

Doing this:
iptables -A INPUT -i eth0 -s 1.1.1.1 -p tcp --dport 25 -j DROP 

Would cause the following to happen:
INPUT -i eth0 -p tcp --dport 25 -j ACCEPT
INPUT -i eth0 -j DROP
INPUT -i eth0 -s 1.1.1.1 -p tcp --dport 25 -j DROP 

This has the port 25 ACCEPT happening before the DROP rule for 1.1.1.1 ... so it
would be accepted.

If you run:
iptables -I INPUT -i eth0 -s 1.1.1.1 -p tcp --dport 25 -j DROP 

Then you would of had:
INPUT -i eth0 -s 1.1.1.1 -p tcp --dport 25 -j DROP 
INPUT -i eth0 -p tcp --dport 25 -j ACCEPT
INPUT -i eth0 -j DROP

As you can see the DROP for 1.1.1.1 comes first .. so SMTP from 1.1.1.1 would be
dropped before the ACCEPT ... blocking SMTP from 1.1.1.1

Michael.


On Mon, 14 Jun 2004 01:54:19 -0700
"Spiro Azkoul" <spiro@snacorp.net> wrote:

> By doing the -I transition no one could connect to my server anymore. 
> 
> Knowing that I had a bunch of rules such as 
> 
> [root@linux root]# iptables -L INPUT 
> Chain INPUT (policy ACCEPT)
> target     prot opt source               destination         
> DROP       all  --  YahooBB219000000000.bbtec.net/8  anywhere           
> DROP       all  --  AAnnecy-204-1-27-120.w81-249.abo.wanadoo.fr  anywhere
> 
> DROP       all  --  61.178.0.0/16        anywhere           
> DROP       all  --  53-bem-10.acn.waw.pl  anywhere           
> DROP       all  --  216.155.64.0/19      anywhere    
> RH-Lokkit-0-50-INPUT  all  --  anywhere             anywhere           
> ACCEPT     tcp  --  anywhere             anywhere           tcp dpt:ssh 
> ACCEPT     tcp  --  anywhere             anywhere           tcp dpt:http 
> ACCEPT     tcp  --  anywhere             anywhere           tcp dpt:smtp 
> ACCEPT     tcp  --  anywhere             anywhere           tcp dpt:pop3
> 
> That did not work
> No one could connect for POP or SMTP. 
> What is wrong with that config?
> Thanks
>        
> 
> 
> 
> 
> 
> 


-- 
Michael Gale
Network Administrator
Utilitran Corporation