IPTables REJECT not blocking port 80

Support for security such as Firewalls and securing linux
Post Reply
jjrowan
Posts: 132
Joined: 2005/09/10 13:07:15
Contact:

IPTables REJECT not blocking port 80

Post by jjrowan » 2020/06/23 13:51:40

My server has been getting frequent attempts from a device on 89.144.x.x. There is nothing on the server for anyone on that network so I tried blocking all access via IPTables.

iptables -L -n |grep 89.144
REJECT tcp -- 89.144.0.0/16 0.0.0.0/0 state NEW tcp reject-with icmp-port-unreachable

But the last two days there have been attempts to access the web server logged in the /var/log/httpd/access_log

I'm not an expert by any means with iptables but I though this would prevent any access from this net block.

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s 89.144.0.0/16 -j REJECT --reject-with icmp-port-unreachable.

What am I missing?

tunk
Posts: 1205
Joined: 2017/02/22 15:08:17

Re: IPTables REJECT not blocking port 80

Post by tunk » 2020/06/23 14:01:01

I assume you have disabled firewalld and installed iptables?
I also think the order of the rules matters, if you have opened
for all http traffic before this rule ...

jjrowan
Posts: 132
Joined: 2005/09/10 13:07:15
Contact:

Re: IPTables REJECT not blocking port 80

Post by jjrowan » 2020/06/23 14:18:28

Yes firewalld disabled and iptables enabled.
The rule to block is above rule permitting port 80 access.

tunk
Posts: 1205
Joined: 2017/02/22 15:08:17

Re: IPTables REJECT not blocking port 80

Post by tunk » 2020/06/23 14:36:51

I had a similar problem which was fixed by putting this in /etc/sysconfig/iptables:
-A INPUT -s 123.45.67.0/20 -j DROP
I have no RH-Firewall-1-INPUT chain, only INPUT, FORWARD and OUTPUT.

User avatar
TrevorH
Site Admin
Posts: 33202
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: IPTables REJECT not blocking port 80

Post by TrevorH » 2020/06/23 15:43:16

RH-Firewall-1-INPUT is something that was used in CentOS 5 and abandoned in 6. It's a relic.
The future appears to be RHEL or Debian. I think I'm going Debian.
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 and 6 are deadest, do not use them.
Use the FAQ Luke

User avatar
jlehtone
Posts: 4523
Joined: 2007/12/11 08:17:33
Location: Finland

Re: IPTables REJECT not blocking port 80

Post by jlehtone » 2020/06/23 16:22:55

Please show what is in table filter, Do use:

Code: Select all

iptables -S

Post Reply