0

I have legacy system on Redhat Linux 5.6, with Nmap 4.11. ( IP: 10.11.4.22 ). I want to block access from this legacy system via every port/protocols to another server( IP: 10.11.4.24 ).

I first flush the existing rules via iptables -f

Then apply following rules

iptables -A INPUT -s 10.11.4.24 -j DROP 
iptables -A OUTPUT -s 10.11.4.24 -j DROP

After that , I am unable ping, access via ssh is restricted but when trying to confirm from nmap somehow nmap can access the destination server 10.11.4.24. How nmap is accessing the destination server to give port status.

PORT     STATE SERVICE
22/tcp   open  ssh
111/tcp  open  rpcbind
631/tcp  open  ipp
792/tcp  open  unknown
3000/tcp open  ppp
5000/tcp open  UPnP
5801/tcp open  vnc-http-1
5802/tcp open  vnc-http-2
5901/tcp open  vnc-1
5902/tcp open  vnc-2
6001/tcp open  X11:1
6002/tcp open  X11:2

Regards Salman

closed as off-topic by roaima, sebasth, user88036, Thomas, Shadur Oct 8 '18 at 13:32

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions describing a problem that can't be reproduced and seemingly went away on its own (or went away when a typo was fixed) are off-topic as they are unlikely to help future readers." – roaima, sebasth, Community, Thomas, Shadur
If this question can be reworded to fit the rules in the help center, please edit the question.

  • did you mean to use -s 10.11.4.22 rather? – Ralph Rönnquist Oct 8 '18 at 6:06
  • No I want to block traffic from 10.11.4.22 to 10.11.4.24. I am making these rules in 10.11.4.22. – Salman Raza Oct 8 '18 at 7:47
  • In that case the second line is nonsense -- it will never match since outbound packets will never have a source IP of 10.11.4.24 – Shadur Oct 8 '18 at 12:49
1

Your output line wants to drop packets that come from your intended destination:

iptables -A OUTPUT -s 10.11.4.24 -j DROP

You probably meant to drop data going to your blocked host instead:

iptables -A OUTPUT --dst 10.11.4.24 -j DROP

Not the answer you're looking for? Browse other questions tagged or ask your own question.