I'm fairly new to IPTABLES, but I've written a script that blocks several of Amazon EC2's IP ranges from an input file, blacklist.txt:
... 220.127.116.11/16 18.104.22.168/16 ...
I also have a separate whilelist.txt file consisting of friendly IP addresses (arbitrary, here) including:
Here's an abbreviated version of the bash script I'm running to block the blacklisted IPs and allow the whitelisted ones:
#!/bin/sh TABLENAME="EC2LIST" iptables -N $TABLENAME # Block These while read ip; do # Create the drop rule iptables -t filter -A $TABLENAME -s $ip -j DROP done <~/ec2block/blacklist.txt # The blacklist location # Delete matching rules from blacklist while read ip; do # Remove any matching explicit whitelisted IPs from Blacklist # This will fail if explicit record doesn't exit. Ommitted check for existence. iptables -t -D $TABLENAME -s $ip -j DROP # Accept this incoming IP iptables -A INPUT -i eth0 -s $ip -j ACCEPT done <~/ec2block/whitelist.txt # Edit this location if needed # Drop incoming packets from EC2LIST iptables -I INPUT -j $TABLENAME
Can I guarantee that an IP with an ACCEPT rule that also falls within a range blocked by a DROP rule will be accepted?
Is there a better, more accepted way of doing this? I've been searching for precedence of the ACCEPT rules vs DROP rules, but I can't find much.
One server is CentOS with another implementation on Gentoo. I can't remember which is which, but one had to use:
service iptables save
Here's an example of output from
$ sudo iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination EC2LIST all -- anywhere anywhere ACCEPT all -- ec2-54-66-1-1.ap-southeast-2.compute.amazonaws.com anywhere ACCEPT all -- ec2-54-67-1-2.ap-southeast-2.compute.amazonaws.com anywhere Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain EC2LIST (1 references) target prot opt source destination DROP all -- ec2-54-66-0-0.ap-southeast-2.compute.amazonaws.com/16 anywhere DROP all -- ec2-54-67-0-0.us-west-1.compute.amazonaws.com/16 anywhere