LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Closed Thread
 
Search this Thread
Old 12-26-2004, 03:31 PM   #1
picox
LQ Newbie
 
Registered: Dec 2004
Posts: 5

Rep: Reputation: 0
blocking an IP using iptables


Hello
i am a linux newbie and i want to block a specific IP that lies behind a proxy server using iptables.
how i can do this?!
in php i can block this IP by using the HTTP_X_FORWARDED_FOR server enviroment.
but how i can do it in the iptables?!
thanx
 
Old 12-26-2004, 04:18 PM   #2
Moy Easwaran
Member
 
Registered: Dec 2004
Distribution: Slackware, OpenBSD
Posts: 44

Rep: Reputation: 19
Code:
iptables -A INPUT -s xxx.xxx.xxx.xxx -j DROP
(or --source instead of -s for greater readability)

The iptables web-page (netfilter.org) has FAQs and HOWTOs.

Moy
 
Old 12-26-2004, 04:53 PM   #3
btmiller
Senior Member
 
Registered: May 2004
Location: In the DC 'burbs
Distribution: Arch, Scientific Linux, Debian, Ubuntu
Posts: 4,078

Rep: Reputation: 297Reputation: 297Reputation: 297
Well, if the connection is being forwarded by a proxy, I don't think there's a good way to block just that connection, since proxy information is not recorded in the IP packet header (the HTTP_X_FORWARDED_FOR is part of the HTTP protocol, while iptables works at a lower level). You could always block all connections from that particular proxy, using the method Moy described.
 
Old 12-26-2004, 04:57 PM   #4
picox
LQ Newbie
 
Registered: Dec 2004
Posts: 5

Original Poster
Rep: Reputation: 0
Thanx but that didnt block it.
maybe i should explain further.
there is only one ISP in my country, and this ISP is using cache proxy server. therefore, all the users are having two IPs:
the first IP: xxx.xxx.xxx.xxx which is the proxy IP
the second IP: yyy.yyy.yyy.yyy which is the user's real IP

if i blocked the first IP,which is the proxy IP, all the users in my country wont be able to browse my site and my site will be useless.

i need to block the real user IP, not the proxy IP. how i can do that??!
 
Old 12-26-2004, 05:00 PM   #5
picox
LQ Newbie
 
Registered: Dec 2004
Posts: 5

Original Poster
Rep: Reputation: 0
Quote:
Originally posted by btmiller
Well, if the connection is being forwarded by a proxy, I don't think there's a good way to block just that connection, since proxy information is not recorded in the IP packet header (the HTTP_X_FORWARDED_FOR is part of the HTTP protocol, while iptables works at a lower level). You could always block all connections from that particular proxy, using the method Moy described.
hmmm
is there any way to block it from apache!? like editing httpd.conf?!
 
Old 12-27-2004, 12:34 AM   #6
brettcave
LQ Newbie
 
Registered: Aug 2004
Location: Johannesburg, South Africa
Distribution: Mandrake, RH, Fedora
Posts: 22

Rep: Reputation: 15
I am guessing you are wanting to restrict access to your website from certain IP's. Maybe squid has an acl that looks at headers..? You could then use transparent proxy in front of your webserver to control access.
Have a look at the "external_acl_type" squid.conf tag with "%{Header} HTTP request header" parameter - not sure if that could work.


Otherwise, as Moy suggested, you can use iptables.
iptables -A INPUT -p tcp --dport 80 -s xx.xx.xx.xx -j ACCEPT # this would be the ISP's proxy address
iptables -A INPUT -p tcp --dport 80 -j DROP # or -j REJECT for nicer.

The above rules will not affect https traffic. Note that if your ISP is using transparent proxy, they probably would not be transparent proxy'ing https traffic, so all secure connections would be from the users' actual IP address, so using rules above for port 443 would probably more or less block everyones access to https on your site.
 
Old 12-10-2010, 03:07 AM   #7
mign5856
LQ Newbie
 
Registered: Dec 2010
Posts: 1

Rep: Reputation: 0
I have same question...,haven't any answer?

I have same question...,haven't any answer?
 
Old 12-10-2010, 02:00 PM   #8
win32sux
Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
mign5856, please start your own thread instead of resurrecting one that's been dead for six years.

Last edited by win32sux; 12-10-2010 at 03:32 PM.
 
  


Closed Thread


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables blocking traffic JJX Linux - Networking 4 11-07-2005 05:36 AM
iptables is blocking sites... The_wave Linux - Networking 9 09-09-2005 04:44 PM
Blocking Emule with Iptables Palula Linux - Networking 12 08-26-2005 12:21 PM
iptables - Blocking an URL ddaas Linux - Security 2 10-14-2004 06:36 PM
Iptables blocking certain websites?? Ikik Linux - Security 3 09-29-2003 02:39 AM


All times are GMT -5. The time now is 06:49 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration