1

I need to set up a shell to block DDOS attacks , but in that script, it's reading some Blocked IPs from /etc/sysconfig/iptables.

The problem is that I don't have this directory, So I'm wondering where should I read the blocked IPs from.

I followed this script by Mr Takefuji. I'm using Debian 7 and have never set Iptables untill now.

2

That directory is a Red Hat/Fedora/RHEL directory so I wouldn't expect it to be on any other distributions of Linux. Here's what's in that file on my Fedora 14 system:

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 631 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 631 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 631 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

Most distros keep this information in different locations, I would determine where Debian keeps it and put this info there. The upside to using a file like this is that it's configured to be used when the iptables "service" is stopped & started.

Again on Fedora the service is this:

$ service iptables start

When that is invoked the file I referenced above is used to establish firewall rules as described in that file.

Going it alone

If you just want to setup your own rules you don't have to use that service, it's a convenience at the end of the day. You can run iptables rules directly. In fact if you look at the format of the file referenced above you'll notice that they are just the contents of a call to iptables:

-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

If you're new to iptables you might find a tool such as firestarter easier to getting going with its setup.

  • The file is here : /var/lib/iptables – Aymane Shuichi Oct 16 '13 at 21:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.