<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">thanks Chuck and Larry, I looked into
it.<br>
<br>
I'm now coming up with <a href="http://ipset.netfilter.org/">ipset</a>,
a Linux utility that can handle multiple IP addresses and interact
with iptables. It's not installed on my BlueOnyx box. Can I <b><tt>yum
install ipset</tt></b> without breaking or getting in conflict
with something on the box?<br>
<br>
Thank you and best regards<br>
<br>
Meaulnes Legler
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td>~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~</td>
</tr>
<tr>
<td>~ <tt> <a class="moz-txt-link-abbreviated" href="http://www.WaveWeb.ch">www.WaveWeb.ch</a> </tt> ~</td>
</tr>
<tr>
<td>~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~</td>
</tr>
<tr>
<td>~ <small><tt>Zurich, Switzerland</tt></small> ~
<br>
~ <small><tt>tel: +41 44 2601660</tt></small> ~</td>
</tr>
</tbody>
</table>
<br>
<br>
On 20.07.16 01:11, Chuck Tetlow wrote:<br>
</div>
<blockquote cite="mid:20160719230519.M39142@tetlow.net" type="cite">
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
<meta content="OPENWEBMAIL" name="GENERATOR">
Meaulnes,
<br>
<br>
You're putting that DROP rule all the way down at the bottom of
the INPUT chain. Its probably behind one or two default "permit
all" rules - which means it won't do a thing.
<br>
<br>
I always put new rules like that at the top of the ACCTIN chain.
That way - I'm sure they are considered before any default "allow"
action. Use the "insert" to line 1 like this:
<br>
iptables -I acctin 1 -s 123.45.67.0/24 -j DROP
<br>
<br>
I guarantee that will block everything from that subnet. And you
can see how much its working using:
<br>
iptables -L -n -v | more
<br>
That will list out all rules, along with the number of packets and
bytes that matched each rule (in your case - were blocked by that
rule).
<br>
<br>
You can also add "--line-numbers" to that iptables command to see
what line in the chain each rule is assigned. That way, if you
want to remove or change a single line - you know which one it is.
<br>
<br>
Good luck.
<br>
<br>
<br>
Chuck
<br>
<br>
<font size="2">
<br>
<br>
<b>---------- Original Message -----------</b>
<br>
From: "\"Meaulnes Legler\"@MailList" <a class="moz-txt-link-rfc2396E" href="mailto:bluelist@waveweb.ch"><bluelist@waveweb.ch></a>
<br>
To: BlueOnyx General Mailing List
<a class="moz-txt-link-rfc2396E" href="mailto:blueonyx@mail.blueonyx.it"><blueonyx@mail.blueonyx.it></a> <br>
Sent: Tue, 19 Jul 2016 21:09:23 +0200 <br>
Subject: [BlueOnyx:19856] iptables <br>
<br>
> hello <br>
> I'm still fighting with iptables against this mail-flooding
to a specific user. I don't understand why mails from a specific
IP like <tt>123.45.67.89</tt> still slip thru although they
should be blocked if included within the subnet <tt>123.45.67.0/24</tt>
... I entered <br>
> <tt># iptables -A INPUT -s 123.45.67.0/24 -j DROP -v</tt>
<br>
> Reading the table with the following returns: <br>
> <tt># iptables -L -n -v | grep </tt><tt><tt>123.45.67</tt>.0/24</tt><tt>
<br>
> </tt><tt> 0 0 DROP all -- * *
69.168.97.0/24 0.0.0.0/0</tt>
<br>
> <br>
> What am I missing? Does iptables need a special
configuration to be able to block subnets? Thank you and best
regards <br>
> <br>
> Meaulnes Legler
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td>~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~</td>
</tr>
<tr>
<td>~ <tt> <a moz-do-not-send="true"
href="http://www.waveweb.ch/"
class="moz-txt-link-abbreviated">www.WaveWeb.ch</a> </tt>
~</td>
</tr>
<tr>
<td>~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~</td>
</tr>
<tr>
<td>~ <small><tt>Zurich, Switzerland</tt> </small> ~ <br>
> ~ <small><tt>tel: +41 44 2601660</tt> </small> ~</td>
</tr>
</tbody>
</table>
<br>
<b>------- End of Original Message -------</b>
<br>
</font>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Blueonyx mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Blueonyx@mail.blueonyx.it">Blueonyx@mail.blueonyx.it</a>
<a class="moz-txt-link-freetext" href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a>
</pre>
</blockquote>
<br>
</body>
</html>