LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 03-29-2006, 10:41 AM   #1
ninjaz
Member
 
Registered: Aug 2003
Location: Michigan
Distribution: RHEL v.4, Debian
Posts: 82

Rep: Reputation: 15
Blocking IP's with IP Tables blocks actual traffic


I get people trying ssh attacks against my computer and I have tried blocking their IP addresses with the firewall in ip tables and it starts to block legitimate traffic. At one point it was blocking traffic going out of the computer. All I did was set up a rule that would drop all traffic coming from that ip or blocks of ip's. Any ideas?
 
Old 03-29-2006, 11:07 AM   #2
Centinul
Member
 
Registered: Jun 2005
Distribution: Gentoo
Posts: 552

Rep: Reputation: 30
I would suggest that you post the rules and/or firewall script so we can all take a look at it.
 
Old 03-29-2006, 05:16 PM   #3
ninjaz
Member
 
Registered: Aug 2003
Location: Michigan
Distribution: RHEL v.4, Debian
Posts: 82

Original Poster
Rep: Reputation: 15
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -j RH-Firewall-1-INPUT
# 210.253.118.91
-A RH-Firewall-1-INPUT -s 210.253.118.91 -j REJECT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -d 224.0.0.251 --dport 5353 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state -m tcp --dport 10000 --state NEW -j ACCEP
T
-A RH-Firewall-1-INPUT -p tcp -m state -m tcp --dport 8080 --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m state -m udp --dport 53 --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state -m tcp --dport 53 --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state -m tcp --dport 22 --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Generated by webmin
*mangle
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed
# Generated by webmin
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed
 
Old 03-31-2006, 02:35 AM   #4
win32sux
LQ Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 380Reputation: 380Reputation: 380Reputation: 380
i haven't looked at your iptables rules, cuz honestly redhat's way of doing rules confuses the heck out of me, but to block some IP which is bugging you just execute something like this:
Code:
iptables -I INPUT -s xxx.xxx.xxx.xxx -j DROP
where xxx.xxx.xxx.xxx is of course the IP you want to deny all access to your box... this rule when executed from the command line should work no matter what your other rules are doing, as the "-I" sends it to the top of the chain...
 
Old 03-31-2006, 03:26 AM   #5
~=gr3p=~
Member
 
Registered: Feb 2005
Location: ~h3av3n~
Distribution: RHEL 4, Fedora Core 3,6,7 Centos 5, Ubuntu 7.04
Posts: 227

Rep: Reputation: 30
Also try using denyhosts kool program

http://denyhosts.sourceforge.net/

Also it's better to run SSH (when giving access to the internet) on a different port rather than the default 22.
 
Old 04-05-2006, 05:31 PM   #6
ninjaz
Member
 
Registered: Aug 2003
Location: Michigan
Distribution: RHEL v.4, Debian
Posts: 82

Original Poster
Rep: Reputation: 15
Thanks gr3p, denyhosts works great.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Using joystick blocks network traffic Alucard243 Slackware 3 07-09-2005 09:41 PM
blocking source ip's using iptables ekkins Linux - Networking 5 06-20-2005 01:10 AM
Blocking Ip's joanduan Linux - Networking 3 03-10-2005 03:54 AM
IP blocking in IP Tables topcat Linux - Security 1 11-24-2004 08:48 AM
How to use IP Tables blocks a CHAT USERS and Sharing Files with P2P or Napster??? LiloAma Linux - Security 14 12-24-2003 08:35 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 07:53 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration