LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices

Reply
 
Search this Thread
Old 10-09-2012, 01:43 PM   #1
cnmoore
Member
 
Registered: Sep 2010
Location: Sunnyvale, CA
Distribution: CentOS 5.5
Posts: 89

Rep: Reputation: 0
iptables - what are the 11.11.11.11 lines?


The iptables on my dedicated server has a lot of lines with 11.11.11.11 that were not put in by me. Such as
-
Code:
-A INPUT -d 11.11.11.11 -p udp -m udp --dport 21 -j DROP 
-A INPUT -d 11.11.11.11 -p tcp -m tcp --dport 21 -j DROP 
-A INPUT -d 11.11.11.11 -p udp -m udp --dport 22 -j DROP 
-A INPUT -d 11.11.11.11 -p tcp -m tcp --dport 22 -j DROP 
-A INPUT -d 11.11.11.11 -p udp -m udp --dport 53 -j DROP 
-A INPUT -d 11.11.11.11 -p tcp -m tcp --dport 53 -j DROP
from the saved iptables.

I asked our host what they were and there was a vague reference to 'placeholder'. But as far as I can see the 11.11.11.11 is never defined in any way. Am I right in thinking that those lines aren't doing anything and I can delete them?

Or do they have a meaning?
 
Old 10-09-2012, 03:56 PM   #2
salasi
Senior Member
 
Registered: Jul 2007
Location: Directly above centre of the earth, UK
Distribution: SuSE, plus some hopping
Posts: 3,910

Rep: Reputation: 776Reputation: 776Reputation: 776Reputation: 776Reputation: 776Reputation: 776Reputation: 776
Well, that's odd. Specifically what's odd is that your host seems to be (more-or-less) admitting to have put them there, but isn't really telling what they were out there for. As a placeholder, you'd have to think that they mean that they might run, eg, sed, and replace that 11.11.11.11 with something actually needed (presumably, what you mean by meaningful).

Incidentally, the range 11.0.0.0 - 11.255.255.255 is allocated to the DoD Network Information Center. So if you never have any accesses to them, they won't do any actual harm (and its only three ports, and probably not three ports that you'll ever want accesses to the DoD for), but I'd agree that you don't want 'random' parts of the net being meaninglessly blocked off, as you'll have a problem with it at some later time when you've forgotten all about this.
 
Old 10-09-2012, 04:31 PM   #3
cnmoore
Member
 
Registered: Sep 2010
Location: Sunnyvale, CA
Distribution: CentOS 5.5
Posts: 89

Original Poster
Rep: Reputation: 0
Thanks

Appreciate your reply, thanks.

A little context here: I first noticed these a few years ago and asked host (they had changed my iptables). I don't think the support person actually knew why he had been told to do it - said "for added security". Anyway it didn't seem to do any harm so I have faithfully copied every time I updated iptables.

But I went on a housecleaning kick yesterday. We had blocked IPs in .htaccess as well as in iptables, and there was also a Ban Filter in the forum. I decided to consolidate all the bans in one place, in iptables, to make search easier if a block turned out to be a mistake. Then I thought why have this stuff I don't understand in iptables - so now I have taken all the 11.11.11.11 lines out.

May I ask you about something else?
I don't really understand the OUTPUT section. There is a pretty large one. It starts with some reasonable-looking stuff:
Code:
-A OUTPUT -p tcp -m tcp --dport 25 -m owner --gid-owner mail -j ACCEPT 
-A OUTPUT -p tcp -m tcp --dport 25 -m owner --uid-owner root -j ACCEPT 
-A OUTPUT -p tcp -m tcp --dport 25 -m owner --uid-owner mail -j ACCEPT 
-A OUTPUT -p tcp -m tcp --dport 25 -j REJECT --reject-with icmp-port-unreachable
But after that are a great many DROP lines - a few of them:
Code:
-A OUTPUT -s 173.201.253.108 -j DROP 
-A OUTPUT -s 95.132.0.0/255.252.0.0 -j DROP 
-A OUTPUT -s 212.156.0.0/255.255.240.0 -j DROP 
-A OUTPUT -s 94.100.16.0/255.255.240.0 -j DROP 
-A OUTPUT -s 94.100.31.74 -j DROP 
-A OUTPUT -s 109.169.56.111 -j DROP 
-A OUTPUT -s 218.108.247.134 -j DROP 
-A OUTPUT -s 203.129.203.3 -j DROP
What are these actually doing? I'm guessing that if something on the server tries to send to 173.201.253.108, it will not succeed. (Protection against malware sending home?) Would you agree that I could just delete those hundred or so lines?
 
Old 10-09-2012, 05:44 PM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,451
Blog Entries: 54

Rep: Reputation: 2895Reputation: 2895Reputation: 2895Reputation: 2895Reputation: 2895Reputation: 2895Reputation: 2895Reputation: 2895Reputation: 2895Reputation: 2895Reputation: 2895
Quote:
Originally Posted by cnmoore View Post
I decided to consolidate all the bans in one place, in iptables, to make search easier if a block turned out to be a mistake.
Management-wise, and because iptables will block a connection at the lowest level, that's an excellent move.


Quote:
Originally Posted by cnmoore View Post
What are these actually doing? Would you agree that I could just delete those hundred or so lines?
They're doing nothing. In the filter table OUTPUT chain rules usually have "-d" for prohibiting sending any traffic to a specific destination, not "-s".
 
Old 10-09-2012, 06:14 PM   #5
cnmoore
Member
 
Registered: Sep 2010
Location: Sunnyvale, CA
Distribution: CentOS 5.5
Posts: 89

Original Poster
Rep: Reputation: 0
Thanks again!
 
  


Reply

Tags
iptables


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] bash: sort lines in 2 files so that equal lines are at the same line number... masavini Programming 10 06-21-2012 01:58 PM
iptables or syslog malforming lines in /var/log/messages >:( suprstar Linux - Server 2 08-10-2010 10:57 AM
iptables DROP, performance effect with n lines? jhwilliams Linux - Software 1 02-01-2009 04:49 AM
Bad Argument '53' IPtables doesn't run and has no bash debug lines? piratebiter Linux - Security 3 09-02-2003 10:18 AM
Iptables, where do i store NAT lines? d33pdream Linux - Software 1 03-18-2003 12:20 AM


All times are GMT -5. The time now is 04:42 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration