reversing program

greenthing · 02-27-2005, 05:45 AM

ok i used a script (source seen at the end of this post) to add ip adresses to iptables but now i want to remove the instead. I have searched google and tryed commands like iptables --flush but after i do i cant connect to the internet. So what i want/need is to modify the script to instead of adding the ips of the downloaded list it should remove them, i have tried to do it my self but i failed misserabley so please help.

Code:

#!/bin/sh

#
# peerguard - Version 0.2
# Author: Brad Cable
# License: GPL Version 2
#


###  Configuration  ###


# uncomment and change this to use a HTTP proxy to retreive the list
#export http_proxy="0.0.0.0:80"

# file to download from the peerguardian database, go to http://www.methlabs.org/sync/ for possible values
pgfile="guarding.p2p"

# temporary directory to use
workdirectory="/tmp/pg"

# path to iptables
iptables="/usr/sbin/iptables"


### End of Configuration ###




########################################
###     DO NOT TOUCH THE REST!!!     ###
########################################


if [ "$UID" != "0" ]; then
	echo "You must be root to run this script.";
	exit;
fi

cleanup(){
	if [ -d "$workdirectory" ]; then
		rm -r $workdirectory
	fi
	rm -rf $pgfile
	rm -rf $pgfile.zip
}

cleanup

mkdir $workdirectory
chown -R nobody $workdirectory
chmod +w $workdirectory
cd $workdirectory

reject="-j REJECT --reject-with icmp-host-unreachable"
nob="su - nobody -c "
wget="cd $workdirectory;wget -q"
if [ ! -z "$http_proxy" ]; then
	wget="export http_proxy='${http_proxy}';$wget"
fi

echo
echo -n "Downloading PeerGuardian File: $pgfile"
$nob"$wget http://www.methlabs.org/sync/$pgfile.zip"

echo -n "... Unzipping..."
unzip $pgfile.zip &> /dev/null
echo -n " Done."
echo

for line in `cat $pgfile`; do

	iprange=`echo $line | cut -d ':' -f2`
	if [ "$iprange" == "$line" ] || [ "$iprange" == "" ]; then
		continue
	fi
	iprange=${iprange:0:${#iprange}-1}

	$iptables -A INPUT -m iprange --src-range $iprange -j DROP
	$iptables -A OUTPUT -m iprange --dst-range $iprange $reject

	echo "     Blocked: $iprange"

done


echo "Blocking Complete"
echo

cleanup

osvaldomarques · 02-27-2005, 09:46 AM

Hi,

Looking at "man iptables" it seems to me you need to replace the command "-A" with "-D" and iptables will look for the rule and, if it is found, will delete it.

greenthing · 02-27-2005, 10:37 AM

I tried that and all i get is this

Code:

Downloading PeerGuardian File: guarding.p2p... Unzipping... Done.
iptables: Bad rule (does a matching rule exist in that chain?)
iptables: Bad rule (does a matching rule exist in that chain?)
     Blocked: 1.0.0.0-3.255.255.255
iptables: Bad rule (does a matching rule exist in that chain?)
iptables: Bad rule (does a matching rule exist in that chain?)
     Blocked: 4.0.25.146-4.0.25.148
iptables: Bad rule (does a matching rule exist in that chain?)
iptables: Bad rule (does a matching rule exist in that chain?)
     Blocked: 4.0.26.14-4.0.29.24
iptables: Bad rule (does a matching rule exist in that chain?)
iptables: Bad rule (does a matching rule exist in that chain?)
     Blocked: 4.0.38.34-4.0.38.36
iptables: Bad rule (does a matching rule exist in that chain?)
iptables: Bad rule (does a matching rule exist in that chain?)
     Blocked: 4.0.38.42-4.0.38.52
iptables: Bad rule (does a matching rule exist in that chain?)
iptables: Bad rule (does a matching rule exist in that chain?)
     Blocked: 4.0.38.58-4.0.38.60
iptables: Bad rule (does a matching rule exist in that chain?)
iptables: Bad rule (does a matching rule exist in that chain?)
     Blocked: 4.0.38.74-4.0.38.80
iptables: Bad rule (does a matching rule exist in that chain?)
iptables: Bad rule (does a matching rule exist in that chain?)
     Blocked: 4.0.38.86-4.0.38.88
iptables: Bad rule (does a matching rule exist in that chain?)
iptables: Bad rule (does a matching rule exist in that chain?)
     Blocked: 4.0.38.114-4.0.38.120
iptables: Bad rule (does a matching rule exist in that chain?)
iptables: Bad rule (does a matching rule exist in that chain?)
     Blocked: 4.0.38.254-4.0.38.255
iptables: Bad rule (does a matching rule exist in that chain?)
iptables: Bad rule (does a matching rule exist in that chain?)
     Blocked: 4.0.159.38-4.0.159.40
iptables: Bad rule (does a matching rule exist in that chain?)
iptables: Bad rule (does a matching rule exist in that chain?)
     Blocked: 4.0.181.86-4.0.181.88
iptables: Bad rule (does a matching rule exist in that chain?)
iptables: Bad rule (does a matching rule exist in that chain?)
     Blocked: 4.0.242.66-4.0.242.80
and so on

osvaldomarques · 02-27-2005, 08:08 PM

Hi,
I got your first rule for a test in a machine which does not run firewall, so I could put any rule for a run:

Code:

Opiii:~# iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
Opiii:~# iptables -A INPUT -m iprange --src-range 21.21.0.0-21.21.0.254 -j DROP
Opiii:~# iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere            source IP range 21.21.0.0-21.21.0.254

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
Opiii:~# iptables -D INPUT -m iprange --src-range 21.21.0.0-21.21.0.253 -j DROP
iptables: Bad rule (does a matching rule exist in that chain?)
Opiii:~# iptables -D INPUT -m iprange --src-range 21.21.0.0-21.21.0.254 -j DROP
Opiii:~# iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I did the following operations:
- list the rules, showing it's clean;
- append an iprange rule;
- list the rules to see if it was accepted;
- try to delete an non existing rule;
- try to delete an existing rule;
- list the rules again;
So, as you can see, the "bad rule message" is for rules you don't have in your firewall. When a rule is accepted, it is done quietly.
As you try to delete two rules at once, one for input and another for output, you receive 2 "bad rule" messages for each "Blocked:' message from your script.

Osvaldo.