IPs blocked still able to connect

IPs blocked still able to connect

[Spiro Azkoul]

Hello

I blocked a subnet by using the following command:
iptables -A INPUT -s 222.0.0.0/8 -j DROP
I then saved it to file
iptables-save > /etc/sysconfig/iptables
and did an iptables -L INPUT to verify that it is in
DROP       all  --  222.0.0.0/8          anywhere

However, i am still receiving SPAM from IPs within that subnet (and others)
long after I thought I completely blocked them from connecting to my server.

I am using RedHat 9 with sendmail, no outgoing SMTP allowed. 

Does anyone have any feedback on this?
Thank you

Re: IPs blocked still able to connect

[Antony Stone]

On Saturday 12 June 2004 9:18 pm, Spiro Azkoul wrote:

> Hello
>
> I blocked a subnet by using the following command:
> iptables -A INPUT -s 222.0.0.0/8 -j DROP
> I then saved it to file
> iptables-save > /etc/sysconfig/iptables
> and did an iptables -L INPUT to verify that it is in
> DROP       all  --  222.0.0.0/8          anywhere
>
> However, i am still receiving SPAM from IPs within that subnet (and others)
> long after I thought I completely blocked them from connecting to my
> server.

Can you show us the headers of such an email, showing that the server which 
directly sent it to you is in that address range?

Try adding a LOG rule immediately after the above DROP rule:

iptables -A INPUT -s 222.0.0.0/8 -j LOG

After you get some more spam, try "iptables -L INPUT -nvx" and see what the 
packet & byte counts are for the two rules.

What are your other rules (output of "iptables -L -nvx")?

Regards,

Antony.

-- 
Wanted: telepath.   You know where to apply.

                                                     Please reply to the list;
                                                           please don't CC me.

RE: IPs blocked still able to connect

[Spiro Azkoul]

Can you show us the headers of such an email, showing that the server which 
directly sent it to you is in that address range?

-I will have to wait until I get the next one rather then trying to find it
in my logged spam folder

Try adding a LOG rule immediately after the above DROP rule:

iptables -A INPUT -s 222.0.0.0/8 -j LOG

-Will do for the next occurrence

After you get some more spam, try "iptables -L INPUT -nvx" and see what the 
packet & byte counts are for the two rules.

What are your other rules (output of "iptables -L -nvx")?

-Lists all allowed and dropped rules. I can put it up here but it's long

Thanks!!

Re: IPs blocked still able to connect

[Michael Gale]

Hello,

	You are using "iptables -A" ... this will append this rule to your list. If you
have an accept rule further up that this connection would match then it will be
accepted but it hits this rule.

You should do a "iptables -I" to insert the rule at the top.

Michael.



On Sat, 12 Jun 2004 13:18:15 -0700
"Spiro Azkoul" <spiro@snacorp.net> wrote:

> Hello
> 
> I blocked a subnet by using the following command:
> iptables -A INPUT -s 222.0.0.0/8 -j DROP
> I then saved it to file
> iptables-save > /etc/sysconfig/iptables
> and did an iptables -L INPUT to verify that it is in
> DROP       all  --  222.0.0.0/8          anywhere
> 
> However, i am still receiving SPAM from IPs within that subnet (and others)
> long after I thought I completely blocked them from connecting to my server.
> 
> I am using RedHat 9 with sendmail, no outgoing SMTP allowed. 
> 
> Does anyone have any feedback on this?
> Thank you
> 
> 
> 
> 
> 
> 
> 


-- 
Michael Gale
Network Administrator
Utilitran Corporation

RE: IPs blocked still able to connect

[Spiro Azkoul]

t

Hello,

	You are using "iptables -A" ... this will append this rule to your
list. If you
have an accept rule further up that this connection would match then it will
be
accepted but it hits this rule.

You should do a "iptables -I" to insert the rule at the top.

Michael.

I am not sure I understand the difference between -I and -A
Where can I find docs on this?
Thanks Michael

Re: IPs blocked still able to connect

[Michael Gale]

Hello,

	You should be able to "man iptables"

-A, --append chain rule-specification
              Append one or more rules to the end of the selected chain.  When
the source and/or destination names resolve to more than  one             
address, a rule will be added for each possible address combination.

-I, --insert chain [rulenum] rule-specification
              Insert one or more rules in the selected chain as the given rule
number.  So, if the rule number is 1, the rule or  rules  are             
inserted at the head of the chain.  This is also the default if no rule number
is specified.



On Sun, 13 Jun 2004 12:36:55 -0700
"Spiro Azkoul" <spiro@snacorp.net> wrote:

> 
> 
> t
> 
> Hello,
> 
> 	You are using "iptables -A" ... this will append this rule to your
> list. If you
> have an accept rule further up that this connection would match then it will
> be
> accepted but it hits this rule.
> 
> You should do a "iptables -I" to insert the rule at the top.
> 
> Michael.
> 
> I am not sure I understand the difference between -I and -A
> Where can I find docs on this?
> Thanks Michael
> 
> 
> 
> 
> 
> 
> 
> 


-- 
Michael Gale
Network Administrator
Utilitran Corporation

RE: IPs blocked still able to connect

[Spiro Azkoul]

Hello,

	You should be able to "man iptables"

-> I did, got the info I needed. Thanks.
I also transferred all my -A rules to -I and an iptables -L INPUT now shows
priority to the -I rules, which basically should not block any traffic to my
server. 

On the other hand, I have a couple more questions:

1- If I have 2 Nic Cards, eth0 and eth1, without any kind of NATing
involved, as I am simply using the private interface for backup jobs, local
SSH and so forth, should I worry about the FORWARD chain? There is no
routing between the 2 interfaces nor do I need there be so I assumed so far
that my INPUT/OUTPUT rules will apply to the public interface without having
to go the extra step of specifying it. 

2- Is there a way to build a text file and have IPTABLES pull from it
periodically? I know this could be done in perl, but has anyone tried to do
it with a simple cron job?

Thanks
 

Re: IPs blocked still able to connect

[Alexis]

----- Original Message ----- 
From: "Spiro Azkoul" <spiro@snacorp.net>
To: <netfilter@lists.netfilter.org>
Sent: Sunday, June 13, 2004 8:59 PM
Subject: RE: IPs blocked still able to connect


>
> Hello,
>
> You should be able to "man iptables"
>
> -> I did, got the info I needed. Thanks.
> I also transferred all my -A rules to -I and an iptables -L INPUT now shows
> priority to the -I rules, which basically should not block any traffic to my
> server.
>
> On the other hand, I have a couple more questions:
>
> 1- If I have 2 Nic Cards, eth0 and eth1, without any kind of NATing
> involved, as I am simply using the private interface for backup jobs, local
> SSH and so forth, should I worry about the FORWARD chain? There is no
> routing between the 2 interfaces nor do I need there be so I assumed so far
> that my INPUT/OUTPUT rules will apply to the public interface without having
> to go the extra step of specifying it.


There's no explicit need of nat to pass the traffic between two interfaces,
without having any nat rule, if you've turned on ip_forwarding, and FORWARD
chain is ACCEPT, traffic will flow between interfaces.



>
> 2- Is there a way to build a text file and have IPTABLES pull from it
> periodically? I know this could be done in perl, but has anyone tried to do
> it with a simple cron job?

the output of iptables-save could help?



> Thanks
>
>
>
>

RE: IPs blocked still able to connect

[Spiro Azkoul]

By doing the -I transition no one could connect to my server anymore. 

Knowing that I had a bunch of rules such as 

[root@linux root]# iptables -L INPUT 
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       all  --  YahooBB219000000000.bbtec.net/8  anywhere           
DROP       all  --  AAnnecy-204-1-27-120.w81-249.abo.wanadoo.fr  anywhere

DROP       all  --  61.178.0.0/16        anywhere           
DROP       all  --  53-bem-10.acn.waw.pl  anywhere           
DROP       all  --  216.155.64.0/19      anywhere    
RH-Lokkit-0-50-INPUT  all  --  anywhere             anywhere           
ACCEPT     tcp  --  anywhere             anywhere           tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere           tcp dpt:http 
ACCEPT     tcp  --  anywhere             anywhere           tcp dpt:smtp 
ACCEPT     tcp  --  anywhere             anywhere           tcp dpt:pop3

That did not work
No one could connect for POP or SMTP. 
What is wrong with that config?
Thanks
       

Re: IPs blocked still able to connect

[Michael Gale]

Hello,

	I did not mean you should be using -I for all your inserts .... when you load
you rules from a script ... a "-A" will work fine. But when adding a rules on
the fly later .. you most likely want to do a "-I" so it is at the top of the
list.

Example:

From script:

iptables -A INPUT -i eth0 -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -i eth0 -j DROP

Now you find that you want to block spam from mai.hotmail.com (1.1.1.1)

Doing this:
iptables -A INPUT -i eth0 -s 1.1.1.1 -p tcp --dport 25 -j DROP 

Would cause the following to happen:
INPUT -i eth0 -p tcp --dport 25 -j ACCEPT
INPUT -i eth0 -j DROP
INPUT -i eth0 -s 1.1.1.1 -p tcp --dport 25 -j DROP 

This has the port 25 ACCEPT happening before the DROP rule for 1.1.1.1 ... so it
would be accepted.

If you run:
iptables -I INPUT -i eth0 -s 1.1.1.1 -p tcp --dport 25 -j DROP 

Then you would of had:
INPUT -i eth0 -s 1.1.1.1 -p tcp --dport 25 -j DROP 
INPUT -i eth0 -p tcp --dport 25 -j ACCEPT
INPUT -i eth0 -j DROP

As you can see the DROP for 1.1.1.1 comes first .. so SMTP from 1.1.1.1 would be
dropped before the ACCEPT ... blocking SMTP from 1.1.1.1

Michael.


On Mon, 14 Jun 2004 01:54:19 -0700
"Spiro Azkoul" <spiro@snacorp.net> wrote:

> By doing the -I transition no one could connect to my server anymore. 
> 
> Knowing that I had a bunch of rules such as 
> 
> [root@linux root]# iptables -L INPUT 
> Chain INPUT (policy ACCEPT)
> target     prot opt source               destination         
> DROP       all  --  YahooBB219000000000.bbtec.net/8  anywhere           
> DROP       all  --  AAnnecy-204-1-27-120.w81-249.abo.wanadoo.fr  anywhere
> 
> DROP       all  --  61.178.0.0/16        anywhere           
> DROP       all  --  53-bem-10.acn.waw.pl  anywhere           
> DROP       all  --  216.155.64.0/19      anywhere    
> RH-Lokkit-0-50-INPUT  all  --  anywhere             anywhere           
> ACCEPT     tcp  --  anywhere             anywhere           tcp dpt:ssh 
> ACCEPT     tcp  --  anywhere             anywhere           tcp dpt:http 
> ACCEPT     tcp  --  anywhere             anywhere           tcp dpt:smtp 
> ACCEPT     tcp  --  anywhere             anywhere           tcp dpt:pop3
> 
> That did not work
> No one could connect for POP or SMTP. 
> What is wrong with that config?
> Thanks
>        
> 
> 
> 
> 
> 
> 


-- 
Michael Gale
Network Administrator
Utilitran Corporation