Iptables - trying to block multiple ip addresses

[Geoff Wild]

Trying to block multiple ip's from my server.

I'm using Easy Firewall Generator for IPTables.

http://easyfwgen.morizot.net/gen/index.php

I've added:

# Drop everyting from the following ip's
echo "Process the bad people ..."
$IPT -A INPUT -p ALL -d 68.122.142.182 -j DROP
$IPT -A INPUT -p ALL -d 68.144.185.86 -j DROP
$IPT -A INPUT -p ALL -d 68.157.86.130 -j DROP
$IPT -A INPUT -p ALL -d 216.185.55.67 -j DROP
$IPT -A INPUT -p ALL -d 68.210.138.17 -j DROP
$IPT -A INPUT -p ALL -d 62.81.176.46 -j DROP
$IPT -A INPUT -p ALL -d 24.82.81.169 -j DROP

Yet, 62.81.176.46 is still being logged in my maillog...

I'm new to iptables - so be gentle....

Server is a DNS, Mail, and web server running RH 9.

Rgds...Geoff

[Geoff Wild]

okay - I think I got it - should be -s (source) not -d

# Drop everyting from the following ip's
echo "Process the bad people ..."
$IPT -A INPUT -p ALL -s 68.122.142.182 -j DROP
$IPT -A INPUT -p ALL -s 68.144.185.86 -j DROP
$IPT -A INPUT -p ALL -s 68.157.86.130 -j DROP
$IPT -A INPUT -p ALL -s 216.185.55.67 -j DROP
$IPT -A INPUT -p ALL -s 68.210.138.17 -j DROP
$IPT -A INPUT -p ALL -s 62.81.176.46 -j DROP
$IPT -A INPUT -p ALL -s 24.82.81.169 -j DROP


Rgds...Geoff

[Steven E. Protter · Accepted solution]

Looks like you have it Geoff.

Are you working on my sendmail deal by using iptables to block the nasty person?

Just wondering. Got to block the soure.

I have ehanced firewall logging going and am planning on matching the mail events to the iptables log and doing a iptables modification myself.

I wouldn't mind seeing your final configuration in my investmenttool@yahoo.com account.

The same guy may be messing with both of us.

I'm going to get those points assigned btw, just dealing with other issues this morning.

SEP

[Steven E. Protter]

I have used your list on my iptables firewall.

I wish to refer to you two ip addresses that have been making my life miserable:

-A INPUT -i eth0 -p ALL -s 66.47.86.187 -j DROP
-A INPUT -i eth0 -p ALL -s 131.178.0.213 -j DROP


Punish them!

I've developing a log analyzer that will give me the ip addresses of repeat users of my formscript.

I will post when its done.

SEP

[Steven E. Protter]

I have a few more for you.

All of these ip's have run formscript.cgi more than 10 times.

Funny thing is, I didn't get a single form from the web.

-A INPUT -i eth0 -p ALL -s 131.178.0.213 -j DROP
-A INPUT -i eth0 -p ALL -s 68.122.142.182 -j DROP
-A INPUT -i eth0 -p ALL -s 68.144.185.86 -j DROP
-A INPUT -i eth0 -p ALL -s 68.157.86.130 -j DROP
-A INPUT -i eth0 -p ALL -s 216.185.55.67 -j DROP
-A INPUT -i eth0 -p ALL -s 68.210.138.17 -j DROP
-A INPUT -i eth0 -p ALL -s 62.81.176.46 -j DROP
-A INPUT -i eth0 -p ALL -s 24.82.81.169 -j DROP
-A INPUT -i eth0 -p ALL -s 12.161.118.34 -j DROP
-A INPUT -i eth0 -p ALL -s 200.11.183.252 -j DROP
-A INPUT -i eth0 -p ALL -s 205.147.224.92 -j DROP
-A INPUT -i eth0 -p ALL -s 207.61.246.194 -j DROP
-A INPUT -i eth0 -p ALL -s 208.186.102.78 -j DROP
-A INPUT -i eth0 -p ALL -s 213.173.154.230 -j DROP
-A INPUT -i eth0 -p ALL -s 194.102.248.251 -j DROP
-A INPUT -i eth0 -p ALL -s 194.254.160.78 -j DROP
-A INPUT -i eth0 -p ALL -s 64.14.144.85 -j DROP

SEP