Hi, > Thanks. If you bear with a couple "hopefully-not-too-naive" questions ... > > I seems to me that you are saying the actions you wish to stop are from > "s <offending_ip>" using "-p tcp" ... why the need to specify the > destination of "-d <my_ip>" (since if this iptables rule is called, it > must have reached me regardless of my_ip) and "--dport 80" (would there > be any destination port that I would allow such action from this > offending_ip to occur on?). Yes, that's correct. You don't need to include the destination if you only have one IP address on that host. > I am seeing in the default F14 iptables: > > -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT > > This looks to me like tcp on dport 22 is allowed and there I would think > that the minimal change would be to insert a rule before this which says > "anything from offending_ip via tcp should be rejected". > > I'm still trying to get comfortable with iptables and, even though there > is alot of stuff out there, I'm still working to get the necessary > critical mass of understanding so it all falls into place. This thread > looked like a good chance to see if I'm closer to understanding. Yes, that's a good approach too. If you are editing the existing iptables config script from /etc/sysconfig/iptables, then that's exactly what you would do. Something like this should work: # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j DROP -s <offending_ip/range> -A INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT the "<offending_ip/range>" might be something like 1.2.3.0/24 to block the entire 256 addresses on that network. HTH, Alex -- users mailing list users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
