LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 01-25-2017, 02:11 AM   #1
Shruti_Soumya
LQ Newbie
 
Registered: Jan 2017
Posts: 1

Rep: Reputation: Disabled
IP Table implementation


I am trying to implement IP tables on my server, to allow around 1500 Ips and reject the rest which are coming.

Questions:
1. Precedence of the rule?
Tried putting these commands:

iptables -A INPUT -m set --match-set setname src -p tcp -m multiport -j ACCEPT

iptables -A INPUT -j DROP

But then was unable to access the server. Performance issue?
Note- by default my server accepts all connections.
 
Old 01-25-2017, 08:59 AM   #2
TB0ne
LQ Guru
 
Registered: Jul 2003
Location: Birmingham, Alabama
Distribution: SuSE, RedHat, Slack,CentOS
Posts: 22,333

Rep: Reputation: 6026Reputation: 6026Reputation: 6026Reputation: 6026Reputation: 6026Reputation: 6026Reputation: 6026Reputation: 6026Reputation: 6026Reputation: 6026Reputation: 6026
Quote:
Originally Posted by Shruti_Soumya View Post
I am trying to implement IP tables on my server, to allow around 1500 Ips and reject the rest which are coming.

Questions: 1. Precedence of the rule? Tried putting these commands:

iptables -A INPUT -m set --match-set setname src -p tcp -m multiport -j ACCEPT
iptables -A INPUT -j DROP

But then was unable to access the server. Performance issue? Note- by default my server accepts all connections.
Sounds very much like a homework question, but it is very easy to try swapping the position of the rules. DROP first, THEN accept.
Code:
iptables -P INPUT -j DROP
iptables -A INPUT -m iprange --src-range 192.193.0-150 -j ACCEPT
...will accept things in the range specified. Modify commands as needed.
 
Old 01-25-2017, 09:34 AM   #3
szboardstretcher
Senior Member
 
Registered: Aug 2006
Location: Detroit, MI
Distribution: GNU/Linux systemd
Posts: 4,237

Rep: Reputation: 1653Reputation: 1653Reputation: 1653Reputation: 1653Reputation: 1653Reputation: 1653Reputation: 1653Reputation: 1653Reputation: 1653Reputation: 1653Reputation: 1653
I think it's worth noting that this example 'can' be misinterpreted if you aren't paying attention. It looks like all traffic is dropped and nothing will ever reach the allow. Ie: A top down ruleset.

But: the '-P' means 'default policy' for the specified chain -- in this case 'INPUT'. So the default policy once a packet has traversed the entire rule set in the chain, is DROP. You could read it in plain english like this:

Code:
iptables -P INPUT -j DROP # If a packet traverses the ENTIRE ruleset in the chain INPUT then DROP
 
1 members found this post helpful.
Old 01-25-2017, 04:36 PM   #4
jefro
Moderator
 
Registered: Mar 2008
Posts: 19,514

Rep: Reputation: 3017Reputation: 3017Reputation: 3017Reputation: 3017Reputation: 3017Reputation: 3017Reputation: 3017Reputation: 3017Reputation: 3017Reputation: 3017Reputation: 3017
Just an idea.
You may also consider using FWbuilder to make it slightly more easy.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
What are the differences between the normal symbol table, the dynamic symbol table, and the debugging symbol table? watchintv Linux - Software 5 10-22-2016 09:38 AM
[SOLVED] MySQL run SELECT on a table if column A form table 1 equals column A from table 2 robertjinx Linux - Software 1 01-15-2016 11:48 AM
libre office writer table 4.2.7.2 build 2 keeps losing cell and table settings 1sweetwater! Linux - Software 5 12-10-2014 01:19 PM
hash table implementation without malloc kapsikum Programming 2 02-25-2013 01:06 PM
[SOLVED] iproute2 in Debian lenny adds routes to the main table instead of desired table donalbane Linux - Networking 3 03-28-2012 12:01 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 05:44 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration