<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
On 01/05/2013 05:22 AM, Fungal Style wrote:
<blockquote cite="mid:BAY157-W3785906D8CC13AC2E785A6A7270@phx.gbl"
type="cite">
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
<div dir="ltr">
Hi all...<br>
<br>
I suspect this would not be an issue for a production machine,
but iptables rules are removed if the server is restarted,
correct?<br>
</div>
</blockquote>
<br>
Depends on /etc/sysconfig/iptables-config<br>
default is to "remove the rules" although it can be changed<br>
<br>
<br>
<br>
<blockquote cite="mid:BAY157-W3785906D8CC13AC2E785A6A7270@phx.gbl"
type="cite">
<div dir="ltr">
<div>> On Thu, 3 Jan 2013, Richard Barker wrote:<br>
> <br>
> > I used this command to block an attacker<br>
> > route add -net x.x.x.x netmask 255.255.255.255
reject<br>
> ><br>
> > if I do a netstat -nrl I get this<br>
> > x.x.x.x - 255.255.255.255 !H - - - -<br>
> ><br>
> > How do I get it removed ?<br>
> <br>
> I've found different versions of route are terribly picky
about syntax,<br>
> in particular, some demand the netmask portion, and some
don't.<br>
> <br>
> Try:<br>
> <br>
> route del -net x.x.x.x netmask 255.255.255.255<br>
> <br>
> and<br>
> <br>
> route add -net x.x.x.x<br>
> <br>
> Your particuar 'man route' man page may provide some
clues.<br>
> <br>
> If you don't want to reboot, you could take the interface
down and bring<br>
> it back up, though clearly you *DON'T* want to do this
unless you have a<br>
> console or alternate method of getting into and
controlling the box as<br>
> you could get locked out if things don't behave as they
should.<br>
> <br>
> Try:<br>
> <br>
> service network restart<br>
> <br>
> That should restart the network with the box's 'default'
network settings<br>
> and any manually entered, but otherwise unsaved routes
should go away.<br>
> <br>
> In general, iptables should be used to block attacks
rather than adding<br>
> null routes:<br>
> <br>
> iptables -A INPUT -s <sourceIP(/netmask) -j DROP
<--- -A adds rule<br>
> <br>
> iptables -D INPUT -s <sourceIP(/netmask) -j DROP
<--- -D deletes rule<br>
> <br>
> Check man iptables for help on that.<br>
> <br>
> =^_^= Tigerwolf<br>
</div>
</div>
<pre wrap="">_
</pre>
</blockquote>
<div class="moz-signature">-- <br>
Gerald </div>
</body>
</html>