I'm trying to block some foreign ip traffic to our webserver. Arin.net shows that the block 117.0.0.0/8 belongs to South Brisbane Australia. But when I block it, it shows up as "localhost/8".
$ sudo iptables -I INPUT -s 117.0.0.0/8 -j DROP -m comment --comment "south brisbane au"
the result from the listing of iptables -L --line-numbers
is:
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 DROP all -- localhost/8 anywhere /* south brisbane au */
What's going on here? Why is 117.0.0.0/8 showing up as "localhost/8"? Will this block affect any traffic to localhost?
UPDATE (and output of accepted solution)
I implemented using -n
as suggested by several including the accepted answer. Here is the output after using -n
:
$ sudo iptables -L -n --line-numbers | head
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 DROP all -- 117.0.0.0/8 0.0.0.0/0 /* south brisbane au */
An added benefit is that, iptables -L
had gotten tremendously slow. I had not had time to look into it; but avoiding the dns lookups also solved that problem. Obviously, the dns lookups on the source were making iptables -L
very very slow with more than a handful in the chain. It now emits the complete 144 in that chain immediately. It seems odd that reverse lookup for the source is the default.
whois
search using APNIC to find out who owns the specific address range (in this case, supposedly an ISP in China.)iptables -n -L --line-numbers
show?tcpdump
,lsof
, ...)