Eljas, Great catch I totally missed that in my code that builds the save file. That has been corrected. http://web56.net/iptables-save.cfg this is the result of iptables-save http://web56.net/iptables-save-output Thanks! > -----Original Message----- > From: Eljas Alakulppi [mailto:Buzer@xxxxxxxxx] > Sent: Thursday, October 23, 2008 4:59 PM > To: Joey; IPTables > Subject: Re: tool to search within cidr blocks > > As a first note, all of your -A LOG_* rules are for ASIA only. For example: > > :LOG_IISG - [0:0] > :CIDR-IISG - [0:0] > -A SMTP_TRAFFIC -j CIDR-IISG > -A LOG_ASIAN -j LOG --log-prefix "SPAM-BLOCK-CIDR-IISG" > -A LOG_ASIAN -j DROP > -A CIDR-IISG -s 137.39.110.153 -j LOG_IISG > > They should change depending on the rule, in this case it should be > LOG_IISG > > Now, this does not explain why anything would ever generate > SPAM-BLOCK-CIDR-TURKEY message as your LOG_TURKEY should be empty. Could > you run > iptables -L LOG_ASIAN -v -n > iptables -L LOG_TURKEY -v -n > before fixing the logging issue and also after applying the fix? > > Could you paste iptables-save output just in case? > > -Eljas Alakulppi > > On Thu, 23 Oct 2008 23:51:26 +0300, Joey <Joey@xxxxxxxxx> wrote: > > >> -----Original Message----- > >> From: netfilter-owner@xxxxxxxxxxxxxxx > > [mailto:netfilter-owner@xxxxxxxxxxxxxxx] > >> On Behalf Of Grant Taylor > >> Sent: Wednesday, October 22, 2008 7:08 PM > >> To: Mail List - Netfilter > >> Subject: Re: tool to search within cidr blocks > >> > >> On 10/22/2008 2:28 PM, Joey wrote: > >> > I have several ranges of IP's being put into iptables. > >> > The IP ranges look like this: > >> > 62.29.0.0/17 > >> > 62.68.192.0/19 > >> > 78.40.224.0/21 > >> > 78.111.96.0/20 > >> > 78.135.0.0/17 > >> > > >> > I am blocking a specific IP from the firewall as logged in messages > >> > 71.74.56.125. > >> > In looking at each block of ip's and using a CIDR calculator I can't > > figure > >> > out what range it's really coming from. The list I have is pretty > >> huge. > >> > Is there a tool or a way to ask iptables what rule it matches? Based > >> on > > all > >> > my calculations I don't have anything declared that would block that > >> IP. > >> > > >> > Thanks! > >> > >> Um, 71.74.56.125 is not part of any of the Class A ranges that you are > >> blocking (62., 77., 78.). So... that sort of implies that something > >> else is blocking it. > >> > >> Do you care to provide the (sanitized) output of an 'iptables-save' for > >> us to look at? > >> > >> > > OK, I have unloaded, flushed, reloaded, regenerated my ip lists and I > > can't > > find why we are blocking the IP number. > > > > Here are the block messages: > > Oct 22 01:27:16 pluto kernel: SPAM-BLOCK-CIDR-TURKEYIN=eth0 OUT= > > MAC=00:0e:0c:67:16:a2:00:e0:1e:cd:e1:23:08:00 SRC=71.74.56.122 > > DST=218.144.124.7 LEN=64 TOS=0x00 PREC=0x00 TTL=46 ID=45805 PROTO=TCP > > SPT=40388 DPT=25 WINDOW=32850 RES=0x00 SYN URGP=0 > > Oct 22 01:27:30 pluto kernel: SPAM-BLOCK-CIDR-TURKEYIN=eth0 OUT= > > MAC=00:0e:0c:67:16:a2:00:e0:1e:cd:e1:23:08:00 SRC=71.74.56.122 > > DST=218.144.124.7 LEN=64 TOS=0x00 PREC=0x00 TTL=46 ID=45806 PROTO=TCP > > SPT=40388 DPT=25 WINDOW=32850 RES=0x00 SYN URGP=0 > > Oct 22 01:27:57 pluto kernel: SPAM-BLOCK-CIDR-TURKEYIN=eth0 OUT= > > MAC=00:0e:0c:67:16:a2:00:e0:1e:cd:e1:23:08:00 SRC=71.74.56.123 > > DST=218.144.124.7 LEN=64 TOS=0x00 PREC=0x00 TTL=47 ID=45807 PROTO=TCP > > SPT=40388 DPT=25 WINDOW=32850 RES=0x00 SYN URGP=0 > > Oct 22 01:34:09 pluto kernel: SPAM-BLOCK-CIDR-TURKEYIN=eth0 OUT= > > MAC=00:0e:0c:67:16:a2:00:e0:1e:cd:e1:23:08:00 SRC=71.74.56.125 > > DST=218.144.124.7 LEN=64 TOS=0x00 PREC=0x00 TTL=43 ID=35071 PROTO=TCP > > SPT=46522 DPT=25 WINDOW=32850 RES=0x00 SYN URGP=0 > > Oct 22 01:34:12 pluto kernel: SPAM-BLOCK-CIDR-TURKEYIN=eth0 OUT= > > MAC=00:0e:0c:67:16:a2:00:e0:1e:cd:e1:23:08:00 SRC=71.74.56.125 > > DST=218.144.124.7 LEN=64 TOS=0x00 PREC=0x00 TTL=43 ID=35072 PROTO=TCP > > SPT=46522 DPT=25 WINDOW=32850 RES=0x00 SYN URGP=0 > > Oct 22 01:34:19 pluto kernel: SPAM-BLOCK-CIDR-TURKEYIN=eth0 OUT= > > MAC=00:0e:0c:67:16:a2:00:e0:1e:cd:e1:23:08:00 SRC=71.74.56.125 > > DST=218.144.124.7 LEN=64 TOS=0x00 PREC=0x00 TTL=43 ID=35073 PROTO=TCP > > SPT=46522 DPT=25 WINDOW=32850 RES=0x00 SYN URGP=0 > > Oct 22 01:34:32 pluto kernel: SPAM-BLOCK-CIDR-TURKEYIN=eth0 OUT= > > MAC=00:0e:0c:67:16:a2:00:e0:1e:cd:e1:23:08:00 SRC=71.74.56.124 > > DST=218.144.124.7 LEN=64 TOS=0x00 PREC=0x00 TTL=42 ID=35074 PROTO=TCP > > SPT=46522 DPT=25 WINDOW=32850 RES=0x00 SYN URGP=0 > > Oct 22 01:34:59 pluto kernel: SPAM-BLOCK-CIDR-TURKEYIN=eth0 OUT= > > MAC=00:0e:0c:67:16:a2:00:e0:1e:cd:e1:23:08:00 SRC=71.74.56.125 > > DST=218.144.124.7 LEN=64 TOS=0x00 PREC=0x00 TTL=43 ID=35075 PROTO=TCP > > SPT=46522 DPT=25 WINDOW=32850 RES=0x00 SYN URGP=0 > > > > Here is the list of IP numbers in an iptables-save format, we build this > > from our ip numbers lists merging into this which then gets loaded at > > each > > respective server. > > > > http://web56.net/iptables-save.cfg > > > > > > Any ideas? This is crazy. > > > > Thanks! > > > > Joey > > > > -- > > To unsubscribe from this list: send the line "unsubscribe netfilter" in > > the body of a message to majordomo@xxxxxxxxxxxxxxx > > More majordomo info at http://vger.kernel.org/majordomo-info.html > > > > -- > Using Opera's revolutionary e-mail client: http://www.opera.com/mail/ -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
