Home / ubuntu / Questions / 37466
Accepted
Wolfy
Asked: 2011-04-28 23:18:40 +0800 CST

When do iptables rules become active?

  • 772

I have an script that bans selected IPs from my server.

Example:

iptables -A INPUT -s 123.123.123.123 -j DROP

My question is: When this rule will start working?

I'm asking this, because yesterday I banned an IP, but it was still connected to my server... is something wrong with my command or something else?

command-line

1 Answers

  1. Best Answer

    Operations with iptables and the ip6tables (for IPv6) commands are applied immediately. You might have a rule in your INPUT chain which accepts the traffic before it reaches this one, like:

    iptables -A INPUT -m tcp -p tcp --dport 80 -j ACCEPT

    If you apply your rule with -A, the rule will be appended after the previous rules and even if you say that traffic from 123.123.123.123 should be blocked, the rule allowing TCP 80 traffic has precedence. It's recommended that you insert a new chain (blocklist below) in your ruleset as in:

    sudo iptables -N blocklist
sudo iptables -I INPUT -j blocklist

    And then apply rules to the blocklist chain instead of the INPUT chain:

    sudo iptables -A blocklist -s 123.123.123.123 -j DROP
    • 5