Results 1 to 3 of 3

Thread: iptables not dropping packets?

  1. #1
    Join Date
    Apr 2007
    Location
    San Francisco
    Beans
    119
    Distro
    Ubuntu 14.04 Trusty Tahr

    iptables not dropping packets?

    I have a home server, and I just installed fail2ban for added security. It is successfully adding rules to my iptables, but I don't think the packets are actually being dropped. For example, I'll ssh into my work computer and ssh into my server, but type in bogus paswords. Then my work computer shows up in the iptables as shown below. However, even after that rule has been added, I can still ssh into my server. Perhaps I am misunderstanding something, but it seems that the iptables are not actually dropping the packets from my work computer. Any thoughts?

    Output of iptables -L:
    Code:
    Chain INPUT (policy ACCEPT)
    target     prot opt source               destination         
    fail2ban-apache-proxy  tcp  --  anywhere             anywhere            multiport dports www,https 
    fail2ban-ssh  tcp  --  anywhere             anywhere            multiport dports ssh 
    
    Chain FORWARD (policy ACCEPT)
    target     prot opt source               destination         
    
    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination         
    
    Chain fail2ban-apache-proxy (1 references)
    target     prot opt source               destination         
    DROP       all  --  58.218.199.227       anywhere            
    DROP       all  --  58.218.199.147       anywhere            
    RETURN     all  --  anywhere             anywhere            
    
    Chain fail2ban-ssh (1 references)
    target     prot opt source               destination         
    DROP       all  --  XXXXXX.sp.cs.cmu.edu  anywhere            
    RETURN     all  --  anywhere             anywhere

  2. #2
    Join Date
    Apr 2007
    Location
    San Francisco
    Beans
    119
    Distro
    Ubuntu 14.04 Trusty Tahr

    Re: iptables not dropping packets?

    I still can't figure this out. Any suggestions?

  3. #3
    Join Date
    Apr 2007
    Location
    San Francisco
    Beans
    119
    Distro
    Ubuntu 14.04 Trusty Tahr

    Re: iptables not dropping packets?

    Ok, so I figured it out with a bit of tinkering. Turns out ssh (keyword used by both fail2ban and iptables) is looked up in /etc/services. The default port is listed as 22. I'm using a non standard port, so iptables was not banning the right port (although, I think it should have been banning every port). Either way, editing my services file got it to drop packets at least on the offending port.

    I hope this helps somebody else someday. =)

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •