[SOLVED] Accessing iptables DROP records

battles · 06-29-2014, 08:37 AM

Code:
num pkts bytes target prot opt in out source destination
7 0 0 DROP all -- * * 110.240.0.0/12 0.0.0.0/0 /* china */
10 11 472 DROP all -- * * 111.240.0.0/12 0.0.0.0/0 /* ~ */

I have these two drop records in my iptables. Most have pkts and bytes of 0. My question is: is pkts=11 and bytes=472 in record 10 showing that source 111.240.0.0/12 has been trying to hit my server again after I put the DROP record in?

Thanks.

psycroptic · 06-29-2014, 01:16 PM

yes, but your DROP rule is matching these requests, and so they should not be getting any response from you. your rule looks like it is working

battles · 06-29-2014, 01:19 PM

Thanks. I didn't think that anything was going back, but I wasn't sure if these were actually retries.

psycroptic · 06-29-2014, 01:22 PM

if you're interested, do a packet trace on the interface you're working on, filtered for a destination address of 111.240.0.0/12. that will show you any traffic originating from you, going to one of those addresses.