0

I run a webserver that caters to an entirely local crowd, so to keep hacking attempts to a minimum, I have inserted a bunch of international IP-blocking rules into my iptables, but my filters don't seem to be working.

For instance, in the *filter section I have the following rule:

-A INPUT -s 101/8 -p tcp -m tcp -j DROP

as part of the set of rules to filter out international traffic.

But I find repeated login attempts from this address: 101.227.170.42 in my lastb output.

Shouldn't the iptables rule filter out these attempts?

1

Try specifying the entire netblock in iptables, like so:

-A INPUT -s 101.0.0.0/8 -j DROP

Also, the order of the rules in iptables is important, as is the "default policy" (i.e. DROP, ALLOW, etc.).

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.