Blocking IP's using iptables command, how? 2

[nerbonne]

Hi, I've seen some references to blocking IP's using a command called iptables. I was wondering if anyone could tell me the exact format of the command since someone from Bulgaria is trying to exploit phpMyAdmin. I am running Fedora Core 1 and Apache with Plesk 7.

Thanks.

 

[QatQat]

OK ,

you may also consider changing PHPmyadmin's port as the unwanted visitor may be using a DSL with dynamic address

anyway here is what you do assumng that your phpmyadmin/php system is the same that connectes to the internet


xx = phpmyadmin/web port on your system (normally 80)
xxx-xxx-xxx-xxx = the address from which the attacks are carried out

iptables -A INPUT -p tcp --dport xx -s xxx-xxx-xxx-xxx -j DROP

This if your configuration is simple(i.e. one only linux box running your internet connection, web server, phpmyadmin and so on) if you have a different configuration please post clear info about your network setup.

QatQat

Life is what happens when you are making other plans.

 

[nerbonne]

Hi,

Your right, my box is fairly simple. I performed the command as instructed and it appeared to work. I'm sure that the attacker is on DSL, but if it comes down to that, I'll probably just block his entire ISP range since I don't have clients from Bulgaria anyway and I could care less.

Is blocking ranges possible? Also, is there a command to print the current config so I can verify the settings?

Thanks for you previous help as well.

 

[QatQat]

OK,

to print the ecurrent config
for the filter table

iptables -L

for the nat table

iptables -t nat -L

commands are obviously case sensitive

To block a range you can use somthing like this

iptables - A INPUT -m iprange --src-range xxx.xxx.xxx.xxx-xxx.xxx.xxx.xxx -j DROP

or, quicker and easier but to use carefully as it may block legitimate traffic, to block all addresses in an ip group (example 165.xxx.xxx.xxx)

iptables -A INPUT -s 165.0.0.0 -p tcp --dport 80 -j DROP

Cheers

QatQat


Life is what happens when you are making other plans.

 

[nerbonne]

Great, thank you very much.

 

[nerbonne]

Can you tell me how to make the changes permanent since it seems that the IP's I add are gone after a server reboot.

 

[zeland]

If I'm not mistaken, when iptables starts up, it will read the rules from /etc/sysconfig/iptables. iptables-save is a command to dump the current iptables settings to a file. So, iptables-save > /etc/sysconfig/iptables should do the trick.

--== Anything can go wrong. It's just a matter of how far wrong it will go till people think its right. ==--

 

[QatQat]

Quick one

service iptables save

This takes care of writing your config to /etc/sysconfig/iptables




QatQat



Life is what happens when you are making other plans.

 

[nerbonne]

Perfect, thanks again.

 

[nerbonne]

The only problem with using "service iptables save" is that it overwrites my previous saves. How can I just append to my file? Should I just edit /etc/sysconfig/iptables by hand?

 

[zeland]

I would suggest that you write a small bash script that will bootstrap iptables. Any changes/amendments should be made to this file first for testing and later committed to iptable's own configuration file if all is well. This way, if you messed something up, just do a service iptables restart to revert back to your old settings quickly.

--== Anything can go wrong. It's just a matter of how far wrong it will go till people think its right. ==--

 

[nerbonne]

How could I block an entire ISP, say 163data.com.cn (since they are #4 on the Spamcop list)?

 

[zeland]

do a dig 163data.com.cn and get it's IP. 163data.com.cn didn't return any results for me but 163.com did - 220.181.29.154. Next go to

http://www.iana.org

lookup the first octet of the IP under the "Internet Protocol v4 Address Space". There you will see that 210/8 Jun 96 APNIC (whois.apnic.net) is under APNIC jurisdiction. Back to iana's main page and follow the link to APNIC site. Do a whois search on the full IP address you got from dig. APNIC tells me that the IP belongs to CHINANET-IDC-BJ and it controlls IP adresses 220.181.0.0 to 220.181.255.255.

Now that you have all the information you need:
iptables -A INPUT -p tcp -m iprange --src-range 220.181.0.0-220.181.255.255 -j DROP
should do what you need.

--== Anything can go wrong. It's just a matter of how far wrong it will go till people think its right. ==--