Home / server / Questions / 941708
Accepted
Zareh Kasparian
Asked: 2018-11-27 11:44:16 +0800 CST

blocked ips not showing up in iptables chains

  • 772

i have used the following rules, to block port-scanners for 24 hours, and unblock scanner ip address after 24 hour, and log the attacker ip address. 

iptables -A INPUT -m recent --name portscan --rcheck --seconds 86400    -j DROP 
iptables -A FORWARD -m recent --name portscan --rcheck --seconds 86400 -j DROP


iptables -A INPUT -m recent --name portscan --remove
iptables -A FORWARD -m recent --name portscan --remove


 
iptables -A INPUT -p tcp -m tcp --dport 139 -m recent --name portscan --set -j LOG --log-prefix "portscan:"
iptables -A INPUT -p tcp -m tcp --dport 139 -m recent --name portscan --set -j DROP
iptables -A FORWARD -p tcp -m tcp --dport 139 -m recent --name portscan --set -j LOG --log-prefix "portscan:"
iptables -A FORWARD -p tcp -m tcp --dport 139 -m recent --name portscan --set -j DROP

everything works fine,and the scanner ip address is getting blocked by iptables. but i am not able to find the blocked ip in any of iptables chains. Scanner ip is only getting logged in the kernel.log file, and i looking for a possible way to remove a single ip instead of re-starting iptables itself.

iptables

1 Answers

  1. Best Answer

    The recent module does not create new rules for each offender that you can query with with Iptables. It simply maintains the list of offenders in memory

    http://ipset.netfilter.org/iptables-extensions.man.html#lbBW

    /proc/net/xt_recent/* are the current lists of addresses and information about each entry of each list.

    Each file in /proc/net/xt_recent/ can be read from to see the current list or written to using the following commands to modify the list:

    echo +addr >/proc/net/xt_recent/DEFAULT

    to add addr to the DEFAULT list

     echo -addr >/proc/net/xt_recent/DEFAULT

    to remove addr from the DEFAULT list

    echo / >/proc/net/xt_recent/DEFAULT

    to flush the DEFAULT list (remove all entries)

    • 1