<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>
Hi all...<BR>
<BR>
I suspect this would not be an issue for a production machine, but iptables rules are removed if the server is restarted, correct?<BR>
<BR>
Brian<BR> <BR>
<DIV>
<DIV id=SkyDrivePlaceholder></DIV>> Date: Thu, 3 Jan 2013 19:06:26 -0500<BR>> From: tigerwolf@tigerden.com<BR>> To: blueonyx@mail.blueonyx.it<BR>> Subject: [BlueOnyx:11896] Re: Need to remove a rejected IP<BR>> <BR>> On Thu, 3 Jan 2013, Richard Barker wrote:<BR>> <BR>> > I used this command to block an attacker<BR>> > route add -net x.x.x.x netmask 255.255.255.255 reject<BR>> ><BR>> > if I do a netstat -nrl I get this<BR>> > x.x.x.x - 255.255.255.255 !H - - - -<BR>> ><BR>> > How do I get it removed ?<BR>> <BR>> I've found different versions of route are terribly picky about syntax,<BR>> in particular, some demand the netmask portion, and some don't.<BR>> <BR>> Try:<BR>> <BR>> route del -net x.x.x.x netmask 255.255.255.255<BR>> <BR>> and<BR>> <BR>> route add -net x.x.x.x<BR>> <BR>> Your particuar 'man route' man page may provide some clues.<BR>> <BR>> If you don't want to reboot, you could take the interface down and bring<BR>> it back up, though clearly you *DON'T* want to do this unless you have a<BR>> console or alternate method of getting into and controlling the box as<BR>> you could get locked out if things don't behave as they should.<BR>> <BR>> Try:<BR>> <BR>> service network restart<BR>> <BR>> That should restart the network with the box's 'default' network settings<BR>> and any manually entered, but otherwise unsaved routes should go away.<BR>> <BR>> In general, iptables should be used to block attacks rather than adding<BR>> null routes:<BR>> <BR>> iptables -A INPUT -s <sourceIP(/netmask) -j DROP <--- -A adds rule<BR>> <BR>> iptables -D INPUT -s <sourceIP(/netmask) -j DROP <--- -D deletes rule<BR>> <BR>> Check man iptables for help on that.<BR>> <BR>> =^_^= Tigerwolf<BR>> _______________________________________________<BR>> Blueonyx mailing list<BR>> Blueonyx@mail.blueonyx.it<BR>> http://mail.blueonyx.it/mailman/listinfo/blueonyx<BR></DIV> </div></body>
</html>