<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
Meaulnes,
<br />
<br />You're putting that DROP rule all the way down at the bottom of the INPUT chain. Its probably behind one or two default "permit all" rules - which means it won't do a thing.
<br />
<br />I always put new rules like that at the top of the ACCTIN chain. That way - I'm sure they are considered before any default "allow" action. Use the "insert" to line 1 like this:
<br />iptables -I acctin 1 -s 123.45.67.0/24 -j DROP
<br />
<br />I guarantee that will block everything from that subnet. And you can see how much its working using:
<br />iptables -L -n -v | more
<br />That will list out all rules, along with the number of packets and bytes that matched each rule (in your case - were blocked by that rule).
<br />
<br />You can also add "--line-numbers" to that iptables command to see what line in the chain each rule is assigned. That way, if you want to remove or change a single line - you know which one it is.
<br />
<br />Good luck.
<br />
<br />
<br />Chuck
<br />
<br /><font size="2">
<br />
<br /><b>---------- Original Message
-----------</b>
<br />
From: "\"Meaulnes Legler\"@MailList"
<bluelist@waveweb.ch>
<br />
To: BlueOnyx General Mailing List <blueonyx@mail.blueonyx.it>
<br />
Sent: Tue, 19 Jul 2016 21:09:23 +0200
<br />
Subject: [BlueOnyx:19856] iptables
<br />
<br />>
hello
<br />> I'm still fighting with iptables against this mail-flooding to
a
specific user. I don't understand why mails from a specific
IP
like <tt>123.45.67.89</tt> still slip thru although they
should
be blocked if included within the subnet
<tt>123.45.67.0/24</tt>
... I
entered
<br />>
<tt># iptables -A INPUT -s 123.45.67.0/24 -j DROP
-v</tt>
<br />> Reading the table with the following
returns:
<br />> <tt># iptables -L -n -v | grep
</tt><tt><tt>123.45.67</tt>.0/24</tt><tt>
<br />>
</tt><tt> 0 0 DROP all -- *
*
69.168.97.0/24 0.0.0.0/0</tt>
<br />>
<br />> What am I
missing? Does iptables need a special configuration
to
be able to block
subnets?
Thank you and best
regards
<br />>
<br />>
Meaulnes
Legler
<table cellspacing="0" cellpadding="0" border="0">
<tbody>
<tr>
<td>~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~</td>
</tr>
<tr>
<td>~ <tt> <a href="http://www.waveweb.ch/" class="moz-txt-link-abbreviated">www.WaveWeb.ch</a> </tt>
~</td>
</tr>
<tr>
<td>~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~</td>
</tr>
<tr>
<td>~ <small><tt>Zurich, Switzerland</tt>
</small>
~
<br />>
~ <small><tt>tel: +41 44
2601660</tt>
</small>
~</td>
</tr>
</tbody>
</table>
<br /><b>------- End of Original Message
-------</b>
<br />
</font>
</BODY>
</HTML>