0

I'm fairly new to IPTABLES, but I've written a script that blocks several of Amazon EC2's IP ranges from an input file, blacklist.txt:

...
54.66.0.0/16
54.67.0.0/16
...

I also have a separate whilelist.txt file consisting of friendly IP addresses (arbitrary, here) including:

54.66.1.1
54.67.1.2

Here's an abbreviated version of the bash script I'm running to block the blacklisted IPs and allow the whitelisted ones:

#!/bin/sh

TABLENAME="EC2LIST"


iptables -N $TABLENAME

# Block These
while read ip; do

    # Create the drop rule
    iptables -t filter -A $TABLENAME -s $ip -j DROP

done <~/ec2block/blacklist.txt  # The blacklist location

# Delete matching rules from blacklist
while read ip; do

    # Remove any matching explicit whitelisted IPs from Blacklist
    # This will fail if explicit record doesn't exit. Ommitted check for existence.
    iptables -t -D $TABLENAME -s $ip -j DROP

    # Accept this incoming IP
    iptables -A INPUT -i eth0 -s $ip -j ACCEPT

done <~/ec2block/whitelist.txt  # Edit this location if needed

# Drop incoming packets from EC2LIST
iptables -I INPUT -j $TABLENAME

Can I guarantee that an IP with an ACCEPT rule that also falls within a range blocked by a DROP rule will be accepted?

Is there a better, more accepted way of doing this? I've been searching for precedence of the ACCEPT rules vs DROP rules, but I can't find much.

One server is CentOS with another implementation on Gentoo. I can't remember which is which, but one had to use:

service iptables save

Here's an example of output from

$ sudo iptables -L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
EC2LIST    all  --  anywhere             anywhere
ACCEPT     all  --  ec2-54-66-1-1.ap-southeast-2.compute.amazonaws.com  anywhere
ACCEPT     all  --  ec2-54-67-1-2.ap-southeast-2.compute.amazonaws.com  anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain EC2LIST (1 references)
target     prot opt source               destination
DROP       all  --  ec2-54-66-0-0.ap-southeast-2.compute.amazonaws.com/16  anywhere
DROP       all  --  ec2-54-67-0-0.us-west-1.compute.amazonaws.com/16  anywhere
  • This is not an answer to your question, but a bit of general shell scripting advice: you should always quote shell variable references (e.g., "$TABLENAME" and "$ip") unless you have a good reason not to and you’re sure you know what you’re doing. – Scott Oct 18 '17 at 16:51
1

Iptables' rules are processed in order. When a rule matches, processing stops. If you use nested chains (namely, EC2LIST), nested chains "return to calling chain" if nothing matches in nested chain.

You can (and should) use this to your advantage. If you have an IP that falls into REJECTED rule and you want to whitelist it, put the ACCEPT rule for it before REJECT/DROP.

  • Thanks jurez -- This is the kind of answer I'm after! Can you clarify a bit more? How can I add them in such a way that the ACCEPT rule takes precedence and confirm the order they're processed? Do I need to add the whitelist items to EC2LIST first? Or add them to INPUT chain and append EC2LIST after? Thanks! – QNeville Oct 18 '17 at 18:31
  • To have a specifi rule take precedence over another more general rule, you have to ensure that more specific rule is processed before more general. This means it has to be higher in the chain. Whether you use nested chains or not, iptables will always start at first rule in the chain, continue with the second, etc. As soon as it encounters a match by ip/interface/protocol/etc., and there will be a -j ACCEPT/DROP/REJECT, this will be the final decision. See "user-specific chains" here: iptables.info/en/structure-of-iptables.html – jurez Oct 19 '17 at 4:14
0

Thanks to jurez, I figured this one out. If I'm adding ACCEPT and DROP rules to the same list, the ACCEPT rules added before the DROP rules will take precedence.

The order of operations may not be entirely correct or conventional, but this configuration works if I'm trying to allow 123.123.123.123 but block the rest of 123.123.0.0 to 123.123.255.255: eg.

iptables -A EC2BLOCK -i eth0 -s 123.123.123.123 -j ACCEPT
iptables -t filter -A EC2BLOCK -s 123.123.0.0/16 -j DROP
iptables -I INPUT -j EC2BLOCK

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.