9

I ran the following iptables commands to create a blacklist rule but used the wrong port:

iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j SSH_WHITELIST
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j ULOG --ulog-prefix SSH_brute_force
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j DROP

How can I undo the above and then redo it for a different port?

12

use iptables -D ... to delete the entries.

iptables -D INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
iptables -D INPUT -p tcp --dport 22 -m state --state NEW -j SSH_WHITELIST
iptables -D INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j ULOG --ulog-prefix SSH_brute_force
iptables -D INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j DROP
6

Run the same commands with -D instead of -A.

Alternatively, if you want to completely reset the iptables, flush everything with iptables -F.

  • 1
    i ran iptables -F and now my server is inaccessible. iptables -F seems to be a bit different from ufw reset. – don bright Oct 31 '15 at 17:30
5

As long as you didn't run the iptables save command, all you should have to do is restart or reload the iptables service. Or, you can do what Bonsi Scott said and delete the rules -- with a caveat. First run:

#iptables -L -n -v --line-numbers

to get the rule number, then all you would have to do is delete the rule by number with:

#iptables -D INPUT <rule number>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.