-s 10.0.0.0/8 -j DROP
-s 172.16.0.0/12 -j DROP
-s 192.168.0.0/16 -j DROP
-s 169.254.0.0/16 -j DROP
-s 176.0.0.0/8 -j DROP

-N droplist
-A INPUT -j droplist
-A FORWARD -j droplist

-A droplist -s 10.0.0.0/8 -j LOG --log-level 4
-A droplist -s 10.0.0.0/8 -j DROP
-A droplist -s 172.16.0.0/12 -j LOG --log-level 4
-A droplist -s 172.16.0.0/12 -j DROP
-A droplist -s 192.168.0.0/16 -j LOG --log-level 4
-A droplist -s 192.168.0.0/16 -j DROP
-A droplist -s 169.254.0.0/16 -j LOG --log-level 4
-A droplist -s 169.254.0.0/16 -j DROP
-A droplist -s 176.0.0.0/8 -j LOG --log-level 4
-A droplist -s 176.0.0.0/8 -j DROP

-N droplist
-N logging
-A INPUT -j droplist
-A FORWARD -j droplist

-A droplist -s 10.0.0.0/8 -j logging
-A droplist -s 172.16.0.0/12 -j logging
-A droplist -s 192.168.0.0/16 -j logging
-A droplist -s 169.254.0.0/16 -j logging
-A droplist -s 176.0.0.0/8 -j logging

-A logging -j LOG --log-level 4
-A logging -j DROP

Yes. Development on IPTables has slowed or almost stopped. The much easier way to work with packet filtering on GNU/Linux systems is NFTables:

https://wiki.nftables.org/

https://wiki.nftables.org/wiki-nftab..._in_10_minutes

Remove IPTables and install NFTables, and then give it a try with your task.

Hi Turbo, thanks for your reply!

So... while I do hate on iptables, I've spent a long time carefully reading all kinds of documentation and finally feel comfortable with it now. If possible I'd like to avoid having to learn something new lol.

Can you think of a better way to achieve my goal within iptables?

thanks for that insight, i have a one question : does it support NFQUEUE ? i am using suricata in IPS mode.

i just found this from linux mint forums : https://forums.linuxmint.com/viewtopic.php?t=288764

looks like i'll have to rebuild my suricata setup

Sunk cost fallacy, it's also what keeps too many on M$ Windows ... but be that as it may, if you wish to throw good money^Wtime after bad, then take a look at this part of your script:

The -A puts the test at the very end of everything else. That's almost certainly not what you want, since some other rule will probably let the packet through first. Instead the -I option can take a number as a parameter in order to place the new rule at a certain position among the existing rules.


UNtested, but something like this is closer:

That of course depends on what rules 1 and 2 are. You definitely want to give the highest priority to processing the loopback and established or related connections.

The details are determined by how the network will be used, what kind of system is this for? Desktop? Router? Server? Other?

Oops. Race condition. Disregard the previous post then.

With NFTables, take a look at sets for dealing with pools of addresses:

https://wiki.nftables.org/wiki-nftables/index.php/Sets

Sorry, I should've posted the entire table for clarity.
So that's the actual begging - end.

As far as I understand, because
are placed at the very beginning, before any other rules, both chains will immediately jump to droplist and traverse the rules in exactly that order and before anything else. If no rule in droplist matches, it will jump back to the beginning of INPUT or FORWARD chain. I got that from here: https://www.lammertbies.nl/nl/comm/info/iptables

I read in the docs that depending where you jump to a custom chain from one of the main chains, iptables will traverse the custom chain and if no rule matches, it jumps back to the original chain one rule below the jump. Is that incorrect? (getting really confused now)

I don't know if you are referring to this web page but building a script to load rules would be a more elegant way. In the end the rules will still be the same.

https://www.cyberciti.biz/faq/iptabl...rom-text-file/

Rules are operated basically in sequential order so option b is not necessarily unsafe but adds an extra step to complicate things a bit.

1 members found this post helpful.

Thank you, that's perfect. I only have two questions, if you don't mind.

1.) if no interface is defined, would the rules be applied to all interfaces? Or do I have to name each separately, i.e for eth0, eth1 etc.?

So this for all interfaces:
2.) Is it possible to add a custom log prefix for each type of packet?

1. All interfaces.
2. Yes --log-prefix "what ever"

Depending on distribution once the script is run there is iptables-save or similar command to save the rules so they are automatically loaded at boot up.

1 members found this post helpful.

Awesome, thanks! Trying to find a +rep or thanks button.

One very last thing, sorry.

Would it be possible to include rules that don't use an IP in the list or script?

For example stuff like this:

Yes if you look at the example script in the posted link it shows additional rules added after the drop list loop.

1 members found this post helpful.

Yeah, thanks. I'll just have a second text file with all those rules and a second loop for that.

I tested the script and basically it does Option a.) from the OP, one LOG and DROP rule, for each IP. With 50 IPs this is extremely long.

Are you sure this is better than Option b.), droplist jumping to logging chain?

You said it adds an extra step, which could complicate things, but also that its not necessarily unsafe.

Could you maybe explain in more detail?

As you seem to be on the trail of a working solution provided by the useful posts of others I will not offer a complete alternate example as that might send you down another possibly unnecessary path.

But I will make a few suggestions for your future explorations:

* Although nftables is the new kid on the block, iptables is very mature and useful and is not going anywhere in a hurry! If you have invested time in learning iptables make use of it, there is no need to scrap what you know - use it!

* When you wish to perform actions on large sets of IP addresses consider use of ipsets: Add new addresses to the set from file, manually or dynamically with other iptables rules, then simply test membership in the set to perform the desired actions.

* When you really just want to block a set of IPs put that rule early in the path, such as in the raw table PREROUTING chain. And if all you really want is a count of attempts by IP, avoid the overhead of logging and just add a counter to the set.

* You may also want to learn to use tc which can also perform tests on set membership and drop packets before they are even presented to iptables for processing - very efficient combination!

* Consider changing the title of your threads here to something less perjorative: iptables is certainly not absolute trash and posturing your question under that title might result in some members with helpful knowledge bypassing the thread altogether.

Good luck with iptables and welcome to LQ!

2 members found this post helpful.

Hello and thanks for the warm welcome!

Also thank you for the awesome info, sorry I wrote the title when I was super mad.

I have heard of ipset yes very cool, but I couldn't find out how to LOG each matched rule with a specific prefix and then drop it.

So far the only way I can see that working is with this script and a simple if & grep to change the prefix string according to what was matched.

How do you add a counter? I thought you're just supposed to do this to see a counter?
I read filtering in PREROUTING is not recommended, because it might be ignored.