0

My ubuntu server firewall blocks the ip I am accessing it from. Here is iptables -L

Chain INPUT (policy DROP)
target     prot opt source               destination
DROP       all  --  192.168.1.1          anywhere
ufw-before-logging-input  all  --  anywhere             anywhere
ufw-before-input  all  --  anywhere             anywhere
ufw-after-input  all  --  anywhere             anywhere
ufw-after-logging-input  all  --  anywhere             anywhere
ufw-reject-input  all  --  anywhere             anywhere
ufw-track-input  all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination
DROP       all  --  192.168.1.1          anywhere
ufw-before-logging-forward  all  --  anywhere             anywhere
ufw-before-forward  all  --  anywhere             anywhere
ufw-after-forward  all  --  anywhere             anywhere
ufw-after-logging-forward  all  --  anywhere             anywhere
ufw-reject-forward  all  --  anywhere             anywhere
ufw-track-forward  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ufw-before-logging-output  all  --  anywhere             anywhere
ufw-before-output  all  --  anywhere             anywhere
ufw-after-output  all  --  anywhere             anywhere
ufw-after-logging-output  all  --  anywhere             anywhere
ufw-reject-output  all  --  anywhere             anywhere
ufw-track-output  all  --  anywhere             anywhere

Chain ufw-after-forward (1 references)
target     prot opt source               destination

Chain ufw-after-input (1 references)
target     prot opt source               destination
ufw-skip-to-policy-input  udp  --  anywhere             anywhere             udp dpt:netbios-ns
ufw-skip-to-policy-input  udp  --  anywhere             anywhere             udp dpt:netbios-dgm
ufw-skip-to-policy-input  tcp  --  anywhere             anywhere             tcp dpt:netbios-ssn
ufw-skip-to-policy-input  tcp  --  anywhere             anywhere             tcp dpt:microsoft-ds
ufw-skip-to-policy-input  udp  --  anywhere             anywhere             udp dpt:bootps
ufw-skip-to-policy-input  udp  --  anywhere             anywhere             udp dpt:bootpc
ufw-skip-to-policy-input  all  --  anywhere             anywhere             ADDRTYPE match dst-type BROADCAST

Chain ufw-after-logging-forward (1 references)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere             limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "

Chain ufw-after-logging-input (1 references)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere             limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "

Chain ufw-after-logging-output (1 references)
target     prot opt source               destination

Chain ufw-after-output (1 references)
target     prot opt source               destination

Chain ufw-before-forward (1 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere             icmp destination-unreachable
ACCEPT     icmp --  anywhere             anywhere             icmp source-quench
ACCEPT     icmp --  anywhere             anywhere             icmp time-exceeded
ACCEPT     icmp --  anywhere             anywhere             icmp parameter-problem
ACCEPT     icmp --  anywhere             anywhere             icmp echo-request
ufw-user-forward  all  --  anywhere             anywhere

Chain ufw-before-input (1 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ufw-logging-deny  all  --  anywhere             anywhere             ctstate INVALID
DROP       all  --  anywhere             anywhere             ctstate INVALID
ACCEPT     icmp --  anywhere             anywhere             icmp destination-unreachable
ACCEPT     icmp --  anywhere             anywhere             icmp source-quench
ACCEPT     icmp --  anywhere             anywhere             icmp time-exceeded
ACCEPT     icmp --  anywhere             anywhere             icmp parameter-problem
ACCEPT     icmp --  anywhere             anywhere             icmp echo-request
ACCEPT     udp  --  anywhere             anywhere             udp spt:bootps dpt:bootpc
ufw-not-local  all  --  anywhere             anywhere
ACCEPT     udp  --  anywhere             224.0.0.251          udp dpt:mdns
ACCEPT     udp  --  anywhere             239.255.255.250      udp dpt:1900
ufw-user-input  all  --  anywhere             anywhere

Chain ufw-before-logging-forward (1 references)
target     prot opt source               destination

Chain ufw-before-logging-input (1 references)
target     prot opt source               destination

Chain ufw-before-logging-output (1 references)
target     prot opt source               destination

Chain ufw-before-output (1 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ufw-user-output  all  --  anywhere             anywhere

Chain ufw-logging-allow (0 references)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere             limit: avg 3/min burst 10 LOG level warning prefix "[UFW ALLOW] "

Chain ufw-logging-deny (2 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere             ctstate INVALID limit: avg 3/min burst 10
LOG        all  --  anywhere             anywhere             limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "

Chain ufw-not-local (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere             ADDRTYPE match dst-type LOCAL
RETURN     all  --  anywhere             anywhere             ADDRTYPE match dst-type MULTICAST
RETURN     all  --  anywhere             anywhere             ADDRTYPE match dst-type BROADCAST
ufw-logging-deny  all  --  anywhere             anywhere             limit: avg 3/min burst 10
DROP       all  --  anywhere             anywhere

Chain ufw-reject-forward (1 references)
target     prot opt source               destination

Chain ufw-reject-input (1 references)
target     prot opt source               destination

Chain ufw-reject-output (1 references)
target     prot opt source               destination

Chain ufw-skip-to-policy-forward (0 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere

Chain ufw-skip-to-policy-input (7 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere

Chain ufw-skip-to-policy-output (0 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere

Chain ufw-track-forward (1 references)
target     prot opt source               destination

Chain ufw-track-input (1 references)
target     prot opt source               destination

Chain ufw-track-output (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere             ctstate NEW
ACCEPT     udp  --  anywhere             anywhere             ctstate NEW

Chain ufw-user-forward (1 references)
target     prot opt source               destination

Chain ufw-user-input (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     udp  --  anywhere             anywhere             udp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     udp  --  anywhere             anywhere             udp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http /* 'dapp_Apache' */
ACCEPT     all  --  192.168.1.1          anywhere
ACCEPT     all  --  192.168.1.0/24       anywhere

Chain ufw-user-limit (0 references)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere             limit: avg 3/min burst 5 LOG level warning prefix "[UFW LIMIT BLOCK] "
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable

Chain ufw-user-limit-accept (0 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere

Chain ufw-user-logging-forward (0 references)
target     prot opt source               destination

Chain ufw-user-logging-input (0 references)
target     prot opt source               destination

Chain ufw-user-logging-output (0 references)
target     prot opt source               destination

Chain ufw-user-output (1 references)
target     prot opt source               destination

iptables -S

-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
-N ufw-after-forward
-N ufw-after-input
-N ufw-after-logging-forward
-N ufw-after-logging-input
-N ufw-after-logging-output
-N ufw-after-output
-N ufw-before-forward
-N ufw-before-input
-N ufw-before-logging-forward
-N ufw-before-logging-input
-N ufw-before-logging-output
-N ufw-before-output
-N ufw-logging-allow
-N ufw-logging-deny
-N ufw-not-local
-N ufw-reject-forward
-N ufw-reject-input
-N ufw-reject-output
-N ufw-skip-to-policy-forward
-N ufw-skip-to-policy-input
-N ufw-skip-to-policy-output
-N ufw-track-forward
-N ufw-track-input
-N ufw-track-output
-N ufw-user-forward
-N ufw-user-input
-N ufw-user-limit
-N ufw-user-limit-accept
-N ufw-user-logging-forward
-N ufw-user-logging-input
-N ufw-user-logging-output
-N ufw-user-output
-A INPUT -j ufw-before-logging-input
-A INPUT -j ufw-before-input
-A INPUT -j ufw-after-input
-A INPUT -j ufw-after-logging-input
-A INPUT -j ufw-reject-input
-A INPUT -j ufw-track-input
-A FORWARD -j ufw-before-logging-forward
-A FORWARD -j ufw-before-forward
-A FORWARD -j ufw-after-forward
-A FORWARD -j ufw-after-logging-forward
-A FORWARD -j ufw-reject-forward
-A FORWARD -j ufw-track-forward
-A OUTPUT -j ufw-before-logging-output
-A OUTPUT -j ufw-before-output
-A OUTPUT -j ufw-after-output
-A OUTPUT -j ufw-after-logging-output
-A OUTPUT -j ufw-reject-output
-A OUTPUT -j ufw-track-output
-A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input
-A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input
-A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input
-A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
-A ufw-after-logging-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-after-logging-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 4 -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A ufw-before-forward -j ufw-user-forward
-A ufw-before-input -i lo -j ACCEPT
-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
-A ufw-before-input -m conntrack --ctstate INVALID -j DROP
-A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 4 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT
-A ufw-before-input -j ufw-not-local
-A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
-A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
-A ufw-before-input -j ufw-user-input
-A ufw-before-output -o lo -j ACCEPT
-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-output -j ufw-user-output
-A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
-A ufw-logging-deny -m conntrack --ctstate INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN
-A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
-A ufw-not-local -j DROP
-A ufw-skip-to-policy-forward -j DROP
-A ufw-skip-to-policy-input -j DROP
-A ufw-skip-to-policy-output -j ACCEPT
-A ufw-track-output -p tcp -m conntrack --ctstate NEW -j ACCEPT
-A ufw-track-output -p udp -m conntrack --ctstate NEW -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 80 -j ACCEPT
-A ufw-user-input -p udp -m udp --dport 80 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 22 -j ACCEPT
-A ufw-user-input -p udp -m udp --dport 22 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 80 -m comment --comment "\'dapp_Apache\'" -j ACCEPT
-A ufw-user-input -s 192.168.1.1/32 -j ACCEPT
-A ufw-user-input -s 192.168.1.0/24 -j ACCEPT
-A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] "
-A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable
-A ufw-user-limit-accept -j ACCEPT

I would like to know what rule is causing that.

DROP       all  --  192.168.1.1          anywhere

This rule is automatically added and deleted in a set amount of time.

EDIT: ps aux

root@buntubox-001:/var/www/html# ps aux
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.3 185172  4908 ?        Ss   Aug24   0:31 /sbin/init
root         2  0.0  0.0      0     0 ?        S    Aug24   0:00 [kthreadd]
root         3  0.0  0.0      0     0 ?        S    Aug24   0:04 [ksoftirqd/0]
root         5  0.0  0.0      0     0 ?        S<   Aug24   0:00 [kworker/0:0H]
root         7  0.0  0.0      0     0 ?        S    Aug24   0:51 [rcu_sched]
root         8  0.0  0.0      0     0 ?        S    Aug24   0:00 [rcu_bh]
root         9  0.0  0.0      0     0 ?        S    Aug24   0:00 [migration/0]
root        10  0.0  0.0      0     0 ?        S    Aug24   0:03 [watchdog/0]
root        11  0.0  0.0      0     0 ?        S    Aug24   0:02 [watchdog/1]
root        12  0.0  0.0      0     0 ?        S    Aug24   0:00 [migration/1]
root        13  0.0  0.0      0     0 ?        S    Aug24   0:02 [ksoftirqd/1]
root        15  0.0  0.0      0     0 ?        S<   Aug24   0:00 [kworker/1:0H]
root        16  0.0  0.0      0     0 ?        S    Aug24   0:00 [kdevtmpfs]
root        17  0.0  0.0      0     0 ?        S<   Aug24   0:00 [netns]
root        18  0.0  0.0      0     0 ?        S<   Aug24   0:00 [perf]
root        19  0.0  0.0      0     0 ?        S    Aug24   0:00 [khungtaskd]
root        20  0.0  0.0      0     0 ?        S<   Aug24   0:00 [writeback]
root        21  0.0  0.0      0     0 ?        SN   Aug24   0:00 [ksmd]
root        22  0.0  0.0      0     0 ?        SN   Aug24   0:04 [khugepaged]
root        23  0.0  0.0      0     0 ?        S<   Aug24   0:00 [crypto]
root        24  0.0  0.0      0     0 ?        S<   Aug24   0:00 [kintegrityd]
root        25  0.0  0.0      0     0 ?        S<   Aug24   0:00 [bioset]
root        26  0.0  0.0      0     0 ?        S<   Aug24   0:00 [kblockd]
root        27  0.0  0.0      0     0 ?        S<   Aug24   0:00 [ata_sff]
root        28  0.0  0.0      0     0 ?        S<   Aug24   0:00 [md]
root        29  0.0  0.0      0     0 ?        S<   Aug24   0:00 [devfreq_wq]
root        33  0.0  0.0      0     0 ?        S    Aug24   0:02 [kswapd0]
root        34  0.0  0.0      0     0 ?        S<   Aug24   0:00 [vmstat]
root        35  0.0  0.0      0     0 ?        S    Aug24   0:00 [fsnotify_mark]
root        36  0.0  0.0      0     0 ?        S    Aug24   0:00 [ecryptfs-kthrea]
root        52  0.0  0.0      0     0 ?        S<   Aug24   0:00 [kthrotld]
root        53  0.0  0.0      0     0 ?        S<   Aug24   0:00 [acpi_thermal_pm]
root        54  0.0  0.0      0     0 ?        S<   Aug24   0:00 [bioset]
root        55  0.0  0.0      0     0 ?        S<   Aug24   0:00 [bioset]
root        56  0.0  0.0      0     0 ?        S<   Aug24   0:00 [bioset]
root        57  0.0  0.0      0     0 ?        S<   Aug24   0:00 [bioset]
root        58  0.0  0.0      0     0 ?        S<   Aug24   0:00 [bioset]
root        59  0.0  0.0      0     0 ?        S<   Aug24   0:00 [bioset]
root        60  0.0  0.0      0     0 ?        S<   Aug24   0:00 [bioset]
root        61  0.0  0.0      0     0 ?        S<   Aug24   0:00 [bioset]
root        62  0.0  0.0      0     0 ?        S    Aug24   0:00 [scsi_eh_0]
root        63  0.0  0.0      0     0 ?        S<   Aug24   0:00 [scsi_tmf_0]
root        64  0.0  0.0      0     0 ?        S    Aug24   0:00 [scsi_eh_1]
root        65  0.0  0.0      0     0 ?        S<   Aug24   0:00 [scsi_tmf_1]
root        67  0.0  0.0      0     0 ?        S    Aug24   0:00 [scsi_eh_2]
root        68  0.0  0.0      0     0 ?        S<   Aug24   0:00 [scsi_tmf_2]
root        69  0.0  0.0      0     0 ?        S    Aug24   0:00 [scsi_eh_3]
root        70  0.0  0.0      0     0 ?        S<   Aug24   0:00 [scsi_tmf_3]
root        75  0.0  0.0      0     0 ?        S<   Aug24   0:00 [ipv6_addrconf]
root        89  0.0  0.0      0     0 ?        S<   Aug24   0:00 [deferwq]
root        90  0.0  0.0      0     0 ?        S<   Aug24   0:00 [charger_manager]
root        92  0.0  0.0      0     0 ?        S<   Aug24   0:00 [bioset]
root       132  0.0  0.0      0     0 ?        S<   Aug24   0:00 [bioset]
root       133  0.0  0.0      0     0 ?        S<   Aug24   0:00 [bioset]
root       134  0.0  0.0      0     0 ?        S<   Aug24   0:00 [bioset]
root       135  0.0  0.0      0     0 ?        S<   Aug24   0:00 [bioset]
root       136  0.0  0.0      0     0 ?        S<   Aug24   0:00 [bioset]
root       137  0.0  0.0      0     0 ?        S<   Aug24   0:00 [bioset]
root       138  0.0  0.0      0     0 ?        S<   Aug24   0:00 [bioset]
root       139  0.0  0.0      0     0 ?        S<   Aug24   0:00 [bioset]
root       141  0.0  0.0      0     0 ?        S<   Aug24   0:00 [kpsmoused]
root       218  0.0  0.0      0     0 ?        S<   Aug24   0:00 [raid5wq]
root       244  0.0  0.0      0     0 ?        S<   Aug24   0:00 [kdmflush]
root       245  0.0  0.0      0     0 ?        S<   Aug24   0:00 [bioset]
root       254  0.0  0.0      0     0 ?        S<   Aug24   0:00 [kdmflush]
root       255  0.0  0.0      0     0 ?        S<   Aug24   0:00 [bioset]
root       268  0.0  0.0      0     0 ?        S<   Aug24   0:00 [bioset]
root       271  0.0  0.0      0     0 ?        S<   Aug24   0:02 [kworker/1:1H]
root       290  0.0  0.0      0     0 ?        S<   Aug24   0:00 [kworker/0:1H]
root       294  0.0  0.0      0     0 ?        S    Aug24   0:08 [jbd2/dm-0-8]
root       295  0.0  0.0      0     0 ?        S<   Aug24   0:00 [ext4-rsv-conver]
root       346  0.0  0.0      0     0 ?        S    Aug24   0:00 [kauditd]
root       358  0.0  0.2  28992  3704 ?        Ss   Aug24   0:15 /lib/systemd/systemd-journald
root       377  0.0  0.0      0     0 ?        S<   Aug24   0:00 [iscsi_eh]
root       389  0.0  0.0      0     0 ?        S<   Aug24   0:00 [ib_addr]
root       390  0.0  0.0 102972  1276 ?        Ss   Aug24   0:00 /sbin/lvmetad -f
root       395  0.0  0.0      0     0 ?        S<   Aug24   0:00 [ib_mcast]
root       396  0.0  0.0      0     0 ?        S<   Aug24   0:00 [ib_nl_sa_wq]
root       398  0.0  0.0      0     0 ?        S<   Aug24   0:00 [ib_cm]
root       399  0.0  0.0      0     0 ?        S<   Aug24   0:00 [iw_cm_wq]
root       401  0.0  0.0      0     0 ?        S<   Aug24   0:00 [rdma_cm]
root       426  0.0  0.2  44788  3876 ?        Ss   Aug24   0:03 /lib/systemd/systemd-udevd
root       723  0.0  0.0      0     0 ?        S<   Aug24   0:00 [ext4-rsv-conver]
systemd+   828  0.0  0.1 100324  2140 ?        Ssl  Aug24   0:01 /lib/systemd/systemd-timesyncd
root       919  0.0  0.2 531376  4068 ?        Ssl  Aug24   0:17 /usr/bin/lxcfs /var/lib/lxcfs/
root       931  0.0  0.0   4400  1172 ?        Ss   Aug24   0:00 /usr/sbin/acpid
root       946  0.0  0.1  20104  2528 ?        Ss   Aug24   0:01 /lib/systemd/systemd-logind
root       953  0.0  0.3 275772  5120 ?        Ssl  Aug24   0:15 /usr/lib/accountsservice/accounts-daemon
message+   960  0.0  0.2  42912  3380 ?        Ss   Aug24   0:02 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activati
syslog     965  0.0  0.2 256396  3060 ?        Ssl  Aug24   0:05 /usr/sbin/rsyslogd -n
root       967  0.0  0.1  29012  2588 ?        Ss   Aug24   0:02 /usr/sbin/cron -f
daemon     969  0.0  0.1  26048  1972 ?        Ss   Aug24   0:00 /usr/sbin/atd -f
root       971  0.0  0.8 303892 12544 ?        S<sl Aug24   2:41 /usr/lib/snapd/snapd
root      1050  0.0  0.3  65524  5516 ?        Ss   Aug24   0:02 /usr/sbin/sshd -D
root      1066  0.0  0.0  13376   148 ?        Ss   Aug24   0:00 /sbin/mdadm --monitor --pid-file /run/mdadm/monitor.pid --daemonise --scan --syslog
root      1075  0.0  0.0   5224   160 ?        Ss   Aug24   0:16 /sbin/iscsid
root      1079  0.0  0.2   5724  3504 ?        S<Ls Aug24   1:16 /sbin/iscsid
mysql     1090  0.0  4.2 1312684 64324 ?       Ssl  Aug24   8:15 /usr/sbin/mysqld
root      1173  0.0  0.0  15940  1468 tty1     Ss+  Aug24   0:00 /sbin/agetty --noclear tty1 linux
root      1182  0.0  0.0  19476   244 ?        Ss   Aug24   0:52 /usr/sbin/irqbalance --pid=/var/run/irqbalance.pid
root      1185  0.0  0.3 277184  4988 ?        Ssl  Aug24   0:00 /usr/lib/policykit-1/polkitd --no-debug
ossecm    1214  0.0  0.1  19356  1832 ?        S    Aug24   0:06 /var/ossec/bin/ossec-maild
root      1218  0.0  0.1  15040  1596 ?        S    Aug24   0:00 /var/ossec/bin/ossec-execd
ossec     1232  0.0  0.2  20444  4004 ?        S    Aug24   0:12 /var/ossec/bin/ossec-analysisd
root      1239  0.0  0.0   6648  1512 ?        S    Aug24   0:24 /var/ossec/bin/ossec-logcollector
root      1261  0.0  0.1   8680  2816 ?        S    Aug24   8:18 /var/ossec/bin/ossec-syscheckd
ossec     1265  0.0  0.1  15220  1752 ?        S    Aug24   0:01 /var/ossec/bin/ossec-monitord
root      1419  0.0  0.2  65408  3496 ?        Ss   Aug24   0:05 /usr/lib/postfix/sbin/master
postfix   1424  0.0  0.2  67644  3692 ?        S    Aug24   0:01 qmgr -l -t unix -u
root      9954  0.0  0.0      0     0 ?        S<   Aug29   0:00 [xfsalloc]
root      9955  0.0  0.0      0     0 ?        S<   Aug29   0:00 [xfs_mru_cache]
root      9958  0.0  0.0      0     0 ?        S    Aug29   0:00 [jfsIO]
root      9959  0.0  0.0      0     0 ?        S    Aug29   0:00 [jfsCommit]
root      9960  0.0  0.0      0     0 ?        S    Aug29   0:00 [jfsCommit]
root      9961  0.0  0.0      0     0 ?        S    Aug29   0:00 [jfsSync]
www-data 10878  0.0  0.8 390800 13072 ?        S    06:25   0:00 /usr/sbin/apache2 -k start
www-data 10879  0.0  0.5 390020  8392 ?        S    06:25   0:00 /usr/sbin/apache2 -k start
www-data 10880  0.0  0.5 390004  8392 ?        S    06:25   0:00 /usr/sbin/apache2 -k start
www-data 10881  0.0  0.5 390004  8392 ?        S    06:25   0:00 /usr/sbin/apache2 -k start
www-data 10882  0.0  0.5 390004  8392 ?        S    06:25   0:00 /usr/sbin/apache2 -k start
root     14046  0.0  0.0      0     0 ?        S    16:09   0:00 [kworker/0:1]
root     14198  0.0  0.0      0     0 ?        S    16:38   0:00 [kworker/1:2]
root     14199  0.0  0.0      0     0 ?        S    16:38   0:00 [kworker/u8:1]
root     14351  0.0  0.0      0     0 ?        S    17:09   0:00 [kworker/0:2]
root     14464  0.0  0.0      0     0 ?        S    17:39   0:00 [kworker/1:1]
root     14466  0.0  0.0      0     0 ?        S    17:39   0:00 [kworker/u8:2]
postfix  14495  0.0  0.2  67476  4372 ?        S    17:52   0:00 pickup -l -t unix -u -c
root     14585  0.0  0.0      0     0 ?        S    18:09   0:00 [kworker/0:0]
root     14586  0.0  0.0      0     0 ?        S    18:09   0:00 [kworker/u8:0]
www-data 14597  0.0  0.5 390004  8392 ?        S    18:11   0:00 /usr/sbin/apache2 -k start
root     14598  0.1  0.3  68084  6060 ?        Ss   18:11   0:00 sshd: root@pts/0
root     14600  1.0  0.2  19616  4564 pts/0    Ss   18:11   0:00 -bash
root     14613  0.0  0.1  34428  2792 pts/0    R+   18:11   0:00 ps aux
root     25501  0.0  2.5 389980 38340 ?        Ss   Aug24   0:25 /usr/sbin/apache2 -k start

OSSEC LOG

2017/09/25 02:07:55 ossec-maild(1223): ERROR: Error Sending email to smtp.live.com (smtp server)
2017/09/25 09:20:06 rootcheck: INFO: Starting rootcheck scan.
2017/09/25 09:26:35 rootcheck: INFO: Ending rootcheck scan.
2017/09/25 14:22:08 ossec-maild(1223): ERROR: Error Sending email to smtp.live.com (smtp server)
2017/09/25 17:44:05 ossec-maild(1223): ERROR: Error Sending email to smtp.live.com (smtp server)
2017/09/25 18:46:35 ossec-syscheckd: INFO: Starting syscheck scan.
2017/09/25 18:55:33 ossec-syscheckd: INFO: Ending syscheck scan.
  • The questions would be: what component (daemon, ...) is adding this rule (DROP ...) to iptables rules ? In fact it seems that a binary is modifying your iptables configuration. Then we cannot reply as we do not know which binary is beeing executed in your machine. Please provide the output of ths ps aux command. – vera Sep 12 '17 at 9:36
  • @vera I have added the output of ps aux to my question. See edited question. – Riz-waan Sep 13 '17 at 22:15
  • you should check your ossec logs to see if you there is iptables rule addition notification or something else related to your blacklisted IP. If so, check also the reason tha tmay be notified. – vera Sep 14 '17 at 7:11
  • @vera Would I have tdo it right after it blocks an IP? – Riz-waan Sep 14 '17 at 11:20
  • I don't think so, logs should be persistent. So even if you see now, you normally would be able to see notifications with their timestamp. – vera Sep 14 '17 at 12:04

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.