2

I'm trying to block some foreign ip traffic to our webserver. Arin.net shows that the block 117.0.0.0/8 belongs to South Brisbane Australia. But when I block it, it shows up as "localhost/8".

$ sudo iptables -I INPUT -s 117.0.0.0/8 -j DROP -m comment --comment "south brisbane au"

the result from the listing of iptables -L --line-numbers is:

Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination
1    DROP       all  --  localhost/8          anywhere             /* south brisbane au */

What's going on here? Why is 117.0.0.0/8 showing up as "localhost/8"? Will this block affect any traffic to localhost?

UPDATE (and output of accepted solution)

I implemented using -n as suggested by several including the accepted answer. Here is the output after using -n:

$ sudo iptables -L -n --line-numbers | head
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination
1    DROP       all  --  117.0.0.0/8          0.0.0.0/0            /* south brisbane au */

An added benefit is that, iptables -L had gotten tremendously slow. I had not had time to look into it; but avoiding the dns lookups also solved that problem. Obviously, the dns lookups on the source were making iptables -L very very slow with more than a handful in the chain. It now emits the complete 144 in that chain immediately. It seems odd that reverse lookup for the source is the default.

3
  • 1
    The ARIN report just means that APNIC is the registrar responsible for that block (check the "Comments" section): you need to do a whois search using APNIC to find out who owns the specific address range (in this case, supposedly an ISP in China.)
    – ErikF
    Feb 25, 2018 at 5:10
  • 1
    Also, what does iptables -n -L --line-numbers show?
    – ErikF
    Feb 25, 2018 at 5:16
  • 1
    reverse lookup or similar humanize-the-numbers is turned on by default for a bunch of things (tcpdump, lsof, ...)
    – thrig
    Feb 25, 2018 at 15:24

1 Answer 1

2

It's a false alarm caused by

% host 117.0.0.0
0.0.0.117.in-addr.arpa domain name pointer localhost.

the owner of the relevant reverse DNS zone putting a "localhost." record on that address. There's a flag to iptables to turn off DNS lookups (-n). This will also make the command run faster as no time is wasted on said lookups.

If you need the owner of that zone use dig as that will show the SOA. You'll need to use the reverse address form (which host or other lookup tools will return):

% dig 0.0.0.117.in-addr.arpa
...
;; AUTHORITY SECTION:
0.117.in-addr.arpa.     86266   IN      SOA     dns1.vietel.com.vn. tuananh.viettel.com.vn. 2008010803 10800 3600 604800 86400
3
  • 1
    beautiful ... that and being a number transposition from 127 made me wonder wether the OP had made a typo. Feb 25, 2018 at 8:18
  • 1
    @RuiFRibeiro I guess you could troll other admins by putting funny records on the (typically unused as they were once for broadcast) .0 addresses. Like iptables-error or such...
    – thrig
    Feb 25, 2018 at 8:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.