0

On a linux server/router, I want to block port 80 only for one IP (example : 1.2.3.4 ) I have been given this example :

### Block Incoming Port Requests (BLOCK PORT)
# To block port 80 only for an ip address 1.2.3.4, enter:
$ iptables -A INPUT -p tcp -s 1.2.3.4 --dport 80 -j DROP
$ iptables -A INPUT -i eth1 -p tcp -s 192.168.1.0/24 --dport 80 -j DROP

I'd guess only the first line is needed. I don't understand what this line does:

$ iptables -A INPUT -i eth1 -p tcp -s 192.168.1.0/24 --dport 80 -j DROP
11
  • -1 You write "I dont understand why this line :" You don't understand why this line what? Why it works? Why it doesn't work? What it does? What do you expect it should do?
    – barlop
    Jul 3, 2015 at 10:32
  • Oh the stressed man put a -1, yay...
    – ArchiT3K
    Jul 3, 2015 at 10:36
  • It's called quality control. It's good that you edited your answer, i'll now remove the -1
    – barlop
    Jul 3, 2015 at 10:37
  • Now why don't you try looking at the website that the example comes from cyberciti.biz/tips/linux-iptables-examples.html and then read the description "#8:Drop Private Network Address On Public Interface IP spoofing is nothing but to stop the following IPv4 address ranges for private networks on your public interfaces. Packets with non-routable source addresses should be rejected using the following syntax:"
    – barlop
    Jul 3, 2015 at 10:52
  • Which part of the above iptables command do you not understand, exactly? If you know what all the other lines mean, you should get that one as well, as they're all very similar.
    – Larssend
    Jul 3, 2015 at 11:46

2 Answers 2

0

To block an attackers ip address called 1.2.3.4, enter only:

$ iptables -A INPUT -s 1.2.3.4 -j DROP 
1
  • That cybercities website that you got the second line from, doesn't really follow best practices...People that are big on iptables are not fans of that page. For example if spoofing were to be done manually with iptables, a better way is apparently home.regit.org/netfilter-en/secure-use-of-helpers do edit..find..anti-spoofing and see the example.
    – barlop
    Jul 3, 2015 at 12:58
0

You should first consult the command's manual page if you do not understand why/how it works. From man iptables:

[!] -p, --protocol protocol

The protocol of the rule or of the packet to check. The specified protocol can be one of tcp, udp, udplite, icmp, esp, ah, sctp or the special keyword "all", or it can be a numeric value, representing one of these protocols or a different one. A protocol name from /etc/protocols is also allowed. A "!" argument before the protocol inverts the test. The number zero is equivalent to all. "all" will match with all protocols and is taken as default when this option is omitted.

[!] -s, --source address[/mask][,...]

Source specification. Address can be either a network name, a hostname, a network IP address (with /mask), or a plain IP address. Hostnames will be resolved once only, before the rule is submitted to the kernel. Please note that specifying any name to be resolved with a remote query such as DNS is a really bad idea. The mask can be either a network mask or a plain number, specifying the number of 1's at the left side of the network mask. Thus, a mask of 24 is equivalent to 255.255.255.0. A "!" argument before the address specification inverts the sense of the address. The flag --src is an alias for this option. Multiple addresses can be specified, but this will expand to multiple rules (when adding with -A), or will cause multiple rules to be deleted (with -D).

-j, --jump target

This specifies the target of the rule; i.e., what to do if the packet matches it. The target can be a user-defined chain (other than the one this rule is in), one of the special builtin targets which decide the fate of the packet immediately, or an extension (see EXTENSIONS below). If this option is omitted in a rule (and -g is not used), then matching the rule will have no effect on the packet's fate, but the counters on the rule will be incremented.

[!] -i, --in-interface name

Name of an interface via which a packet was received (only for packets entering the INPUT, FORWARD and PREROUTING chains). When the "!" argument is used before the interface name, the sense is inverted. If the interface name ends in a "+", then any interface which begins with this name will match. If this option is omitted, any interface name will match.

tcp

These extensions can be used if `--protocol tcp' is specified. It provides the following options: [..]

[!] --destination-port,--dport port[:port]

Destination port or port range specification. The flag --dport is a convenient alias for this option. [..]

Therefore, the iptables command you are asking about reads: 'drop (-j DROP) TCP packets (-p tcp) from IP addresses 192.168.1.0-192.168.1.255 (-s 192.168.1.0/24) that are directed at port 80 (--dport 80) on this host (-A INPUT) and coming in on interface eth1 (-i eth1).'

Note that if the -t flag is not specified, -t filter is implied (this is also mentioned in the manual).

Update (based on comment from OP):
The above iptables line does not have anything to do with packets coming from IP address 1.2.3.4, and should probably be left out if the server/router does not have to block packets originating from the 192.168.1.0/24 subnet.

6
  • that s not an answer, excuse me. And I already read it. ...
    – ArchiT3K
    Jul 3, 2015 at 12:46
  • How does my post not answer the question "As a iptables noob, I d guess only the first line is needed. I dont understand what this line does: $ iptables -A INPUT -i eth1 -p tcp -s 192.168.1.0/24 --dport 80 -j DROP". My post explains exactly that particular line.
    – Larssend
    Jul 3, 2015 at 12:48
  • Well, you do explain this line. But I dont understand why it is need to block 1.2.3.4 ...
    – ArchiT3K
    Jul 3, 2015 at 12:49
  • @ArchiT3K: I see. I've edited my answer.
    – Larssend
    Jul 3, 2015 at 12:56
  • Thanks, you re the man. Thanks to all of you. A light turns on in my head. Bon weekend
    – ArchiT3K
    Jul 3, 2015 at 12:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .