Iptables did not work

Discussion in 'Installation/Configuration' started by Captain, Apr 26, 2011.

  1. Captain

    Captain Member

    Hello!

    I block one IP:

    Code:
    [email protected]:~# iptables -L -n
    Chain INPUT (policy DROP)
    target     prot opt source               destination
    fail2ban-courierauth  tcp  --  0.0.0.0/0            0.0.0.0/0           multiport dports 25,465,143,220,993,110,995
    fail2ban-postfix  tcp  --  0.0.0.0/0            0.0.0.0/0           multiport dports 25,465
    DROP       tcp  --  0.0.0.0/0            127.0.0.0/8
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
    DROP       all  --  224.0.0.0/4          0.0.0.0/0
    PUB_IN     all  --  0.0.0.0/0            0.0.0.0/0
    PUB_IN     all  --  0.0.0.0/0            0.0.0.0/0
    PUB_IN     all  --  0.0.0.0/0            0.0.0.0/0
    PUB_IN     all  --  0.0.0.0/0            0.0.0.0/0
    DROP       all  --  0.0.0.0/0            0.0.0.0/0
    DROP       all  --  189.61.231.168       0.0.0.0/0
    DROP       tcp  --  189.61.231.168       0.0.0.0/0           tcp dpt:25
    DROP       tcp  --  189.61.231.168       0.0.0.0/0           tcp dpt:110
    DROP       tcp  --  189.61.231.168       0.0.0.0/0           tcp dpt:143
    
    Chain FORWARD (policy DROP)
    target     prot opt source               destination
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    DROP       all  --  0.0.0.0/0            0.0.0.0/0
    
    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination
    PUB_OUT    all  --  0.0.0.0/0            0.0.0.0/0
    PUB_OUT    all  --  0.0.0.0/0            0.0.0.0/0
    PUB_OUT    all  --  0.0.0.0/0            0.0.0.0/0
    PUB_OUT    all  --  0.0.0.0/0            0.0.0.0/0
    
    Chain INT_IN (0 references)
    target     prot opt source               destination
    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0
    DROP       all  --  0.0.0.0/0            0.0.0.0/0
    
    Chain INT_OUT (0 references)
    target     prot opt source               destination
    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
    
    Chain PAROLE (10 references)
    target     prot opt source               destination
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
    
    Chain PUB_IN (4 references)
    target     prot opt source               destination
    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 3
    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 0
    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 11
    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 8
    PAROLE     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:21
    PAROLE     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:22
    PAROLE     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:25
    PAROLE     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:53
    PAROLE     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80
    PAROLE     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:81
    PAROLE     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:110
    PAROLE     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:143
    PAROLE     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:443
    PAROLE     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:10000
    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:53
    DROP       icmp --  0.0.0.0/0            0.0.0.0/0
    DROP       all  --  0.0.0.0/0            0.0.0.0/0
    
    Chain PUB_OUT (4 references)
    target     prot opt source               destination
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
    
    Chain fail2ban-apache (0 references)
    target     prot opt source               destination
    
    Chain fail2ban-courierauth (1 references)
    target     prot opt source               destination
    RETURN     all  --  0.0.0.0/0            0.0.0.0/0
    
    Chain fail2ban-postfix (1 references)
    target     prot opt source               destination
    RETURN     all  --  0.0.0.0/0            0.0.0.0/0
    
    Chain fail2ban-proftpd (0 references)
    target     prot opt source               destination
    RETURN     all  --  0.0.0.0/0            0.0.0.0/0
    
    
    But in auth.log and mail.log I see failed connection:
    mail.warn
    Code:
    Apr 26 21:01:17 srv postfix/smtpd[30134]: warning: unknown[189.61.231.168]: SASL LOGIN authentication failed: authentication failure
    Apr 26 21:02:23 srv postfix/smtpd[30134]: last message repeated 13 times
    Apr 26 21:03:14 srv postfix/smtpd[30134]: last message repeated 6 times
    Apr 26 21:03:14 srv postfix/smtpd[30134]: warning: 189.61.231.168: hostname bd3de7a8.virtua.com.br verification failed: Name or service not known
    Apr 26 21:03:17 srv postfix/smtpd[30134]: warning: unknown[189.61.231.168]: SASL LOGIN authentication failed: authentication failure
    Apr 26 21:04:23 srv postfix/smtpd[30134]: last message repeated 13 times
    Apr 26 21:05:16 srv postfix/smtpd[30134]: last message repeated 6 times
    Apr 26 21:05:16 srv postfix/smtpd[30134]: warning: 189.61.231.168: hostname bd3de7a8.virtua.com.br verification failed: Name or service not known
    Apr 26 21:05:20 srv postfix/smtpd[30134]: warning: unknown[189.61.231.168]: SASL LOGIN authentication failed: authentication failure
    Apr 26 21:06:22 srv postfix/smtpd[30134]: last message repeated 12 times
    Apr 26 21:07:19 srv postfix/smtpd[30134]: last message repeated 7 times
    Apr 26 21:07:19 srv postfix/smtpd[30134]: warning: 189.61.231.168: hostname bd3de7a8.virtua.com.br verification failed: Name or service not known
    Apr 26 21:07:22 srv postfix/smtpd[30134]: warning: unknown[189.61.231.168]: SASL LOGIN authentication failed: authentication failure
    Apr 26 21:08:28 srv postfix/smtpd[30134]: last message repeated 13 times
    Apr 26 21:09:19 srv postfix/smtpd[30134]: last message repeated 6 times
    Apr 26 21:09:19 srv postfix/smtpd[30134]: warning: 189.61.231.168: hostname bd3de7a8.virtua.com.br verification failed: Name or service not known
    Apr 26 21:09:22 srv postfix/smtpd[30134]: warning: unknown[189.61.231.168]: SASL LOGIN authentication failed: authentication failure
    Apr 26 21:10:29 srv postfix/smtpd[30134]: last message repeated 13 times
    Apr 26 21:11:22 srv postfix/smtpd[30134]: last message repeated 6 times
    Apr 26 21:11:22 srv postfix/smtpd[30134]: warning: 189.61.231.168: hostname bd3de7a8.virtua.com.br verification failed: Name or service not known
    Apr 26 21:11:25 srv postfix/smtpd[30134]: warning: unknown[189.61.231.168]: SASL LOGIN authentication failed: authentication failure
    Apr 26 21:12:26 srv postfix/smtpd[30134]: last message repeated 12 times
    Apr 26 21:13:28 srv postfix/smtpd[30134]: last message repeated 7 times
    Apr 26 21:13:28 srv postfix/smtpd[30134]: warning: 189.61.231.168: hostname bd3de7a8.virtua.com.br verification failed: Name or service not known
    Apr 26 21:13:31 srv postfix/smtpd[30134]: warning: unknown[189.61.231.168]: SASL LOGIN authentication failed: authentication failure
    Apr 26 21:14:37 srv postfix/smtpd[30134]: last message repeated 13 times
    Apr 26 21:15:29 srv postfix/smtpd[30134]: last message repeated 6 times
    Apr 26 21:15:29 srv postfix/smtpd[30134]: warning: 189.61.231.168: hostname bd3de7a8.virtua.com.br verification failed: Name or service not known
    
    How I can block this connection?

    Thnk you!
     
  2. Ben

    Ben ISPConfig Developer ISPConfig Developer

    How did you setup this manual rule? What I am missing is e.g. the state for New and Established connections in the drop rule.

    It looks like you are running fail2ban, but it seams that it does not block these attempts automatically?!
     
  3. Captain

    Captain Member

    To block this IP adress I use:

    Code:
    iptables -A INPUT -s 189.61.231.168 -j DROP
    iptables -A INPUT -s 189.61.231.168 -p tcp --destination-port 25 -j DROP
    
    Yes I have fail2ban. I see in config file that sasl chack is disable.
    Now I enable it. But why dont work IP tables rules for this IP?

    I restart fail2ban and i fail2ban.log:

    Code:
    2011-04-27 23:04:00,279 fail2ban.actions.action: ERROR  iptables -N fail2ban-couriersmtp
    iptables -A fail2ban-couriersmtp -j RETURN
    iptables -I INPUT -p tcp -m multiport --dports smtp,ssmtp -j fail2ban-couriersmtp returned 200
    2011-04-27 23:04:00,280 fail2ban.jail   : INFO   Jail 'apache' started
    2011-04-27 23:04:00,281 fail2ban.jail   : INFO   Jail 'courierauth' started
    2011-04-27 23:04:00,283 fail2ban.jail   : INFO   Jail 'proftpd' started
    2011-04-27 23:04:00,284 fail2ban.actions.action: ERROR  iptables -N fail2ban-postfix
    iptables -A fail2ban-postfix -j RETURN
    iptables -I INPUT -p tcp -m multiport --dports smtp,ssmtp -j fail2ban-postfix returned 200
    2011-04-27 23:04:00,287 fail2ban.actions.action: ERROR  iptables -N fail2ban-sasl
    iptables -A fail2ban-sasl -j RETURN
    iptables -I INPUT -p tcp -m multiport --dports smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s -j fail2ban-sasl returned 400
    2011-04-27 23:04:00,289 fail2ban.actions.action: ERROR  iptables -N fail2ban-ssh
    iptables -A fail2ban-ssh -j RETURN
    iptables -I INPUT -p tcp -m multiport --dports ssh -j fail2ban-ssh returned 400
    2011-04-27 23:04:00,290 fail2ban.actions.action: ERROR  iptables -N fail2ban-apache
    iptables -A fail2ban-apache -j RETURN
    iptables -I INPUT -p tcp -m multiport --dports http,https -j fail2ban-apache returned 200
    2011-04-27 23:04:00,290 fail2ban.actions.action: ERROR  iptables -N fail2ban-proftpd
    iptables -A fail2ban-proftpd -j RETURN
    iptables -I INPUT -p tcp -m multiport --dports ftp,ftp-data,ftps,ftps-data -j fail2ban-proftpd returned 200
    
    How I can to solve this problem?

    Thnks for help.
     
    Last edited: Apr 27, 2011
  4. neobcn

    neobcn New Member

    not blocking

    I have problem i need block certains IP i put this:
    HTML:
    iptables -A INPUT -s 189.61.231.168 -j DROP
    iptables -A INPUT -s 189.61.231.168 -p tcp --destination-port 25 -j DROP

    but not block specially port 80

    fail2ban is ok?

    please help
     
  5. 8omas

    8omas Member HowtoForge Supporter

Share This Page