{"id":3521,"date":"2014-08-31T05:39:20","date_gmt":"2014-08-31T10:39:20","guid":{"rendered":"https:\/\/secure.rosehosting.com\/blog\/?p=3521"},"modified":"2022-06-03T03:46:43","modified_gmt":"2022-06-03T08:46:43","slug":"blocking-abusive-ip-addresses-using-iptables-firewall-in-debianubuntu","status":"publish","type":"post","link":"https:\/\/www.rosehosting.com\/blog\/blocking-abusive-ip-addresses-using-iptables-firewall-in-debianubuntu\/","title":{"rendered":"Iptables Block IP"},"content":{"rendered":"
<\/p>\n
Today we’ll show you how to block ip address using iptables. In the following article we are adding a blacklist to the firewall script which will allow you to block any abusive IP addresses or ranges of IPs in your Debian<\/strong> or Ubuntu<\/strong> based virtual server. Iptables is a user space application program that allows a system administrator to configure the tables provided by the Linux kernel firewall (implemented as different Netfilter modules<\/em>) and the chains and rules it stores. Blocking an IP address using iptables is fairly easy task and it should take no more then 5 minutes.<\/p>\n <\/p>\n Before proceeding any further, make sure you read the tutorial on how to secure\/design the firewall in your linux vps<\/a>. This includes:<\/p>\n To block some abusive IP address or range of IPs, you can use the following For better readability and maintenance, it is a good idea to have all abusing IPs in one particular file, for example So, create or edit make sure the script is executable by adding an ‘x’ bit to it:<\/p>\n To apply the firewall rules and block the abusers, you need to just execute the Of course you don\u2019t have to block IP addresses using iptables, if you use one of our Linux VPS hosting<\/a> services, in which case you can simply ask our expert linux admins to block any IP address for you. They are available 24\u00d77 and will take care of your request immediately.<\/p>\n PS.<\/strong> <\/span>If you liked this post on how to block IP addresses using iptables, please share it with your friends on the social networks using the buttons on the left or simply leave a reply below. Thank you.<\/p>\n","protected":false},"excerpt":{"rendered":" Today we’ll show you how to block ip address using iptables. In the following article we are adding a blacklist … <\/p>\n\n
Block IP Using iptables<\/h3>\n
iptables<\/code> rules:<\/p>\n
## iptables -I INPUT -s 1.2.3.4 -j DROP\r\n## iptables -I INPUT -s 1.2.0.0\/16 -j DROP<\/pre>\n
Creating the Blacklist in iptables<\/h3>\n
\/etc\/blacklist.ips<\/code>. This way, you can add the IP addresses or subnets in this file (one IP or subnet per line<\/i>) and use the
fwall-rules<\/code> script below to block anything listed in this file.<\/p>\n
\/usr\/local\/bin\/fwall-rules<\/code> and make it as follows:<\/p>\n
#!\/bin\/bash\r\n#\r\n# iptables firewall script\r\n# https:\/\/www.rosehosting.com\r\n#\r\n\r\nIPTABLES=\/sbin\/iptables\r\nBLACKLIST=\/etc\/blacklist.ips\r\n\r\necho \" * flushing old rules\"\r\n${IPTABLES} --flush\r\n${IPTABLES} --delete-chain\r\n${IPTABLES} --table nat --flush\r\n${IPTABLES} --table nat --delete-chain\r\n\r\necho \" * setting default policies\"\r\n${IPTABLES} -P INPUT DROP\r\n${IPTABLES} -P FORWARD DROP\r\n${IPTABLES} -P OUTPUT ACCEPT\r\n\r\necho \" * allowing loopback devices\"\r\n${IPTABLES} -A INPUT -i lo -j ACCEPT\r\n${IPTABLES} -A OUTPUT -o lo -j ACCEPT\r\n\r\n${IPTABLES} -A INPUT -p tcp ! --syn -m state --state NEW -j DROP\r\n${IPTABLES} -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\r\n\r\n## BLOCK ABUSING IPs HERE ##\r\n#echo \" * BLACKLIST\"\r\n#${IPTABLES} -A INPUT -s _ABUSIVE_IP_ -j DROP\r\n#${IPTABLES} -A INPUT -s _ABUSIVE_IP2_ -j DROP\r\n\r\necho \" * allowing ssh on port 5622\"\r\n${IPTABLES} -A INPUT -p tcp --dport 5622 -m state --state NEW -j ACCEPT\r\n\r\necho \" * allowing ftp on port 21\"\r\n${IPTABLES} -A INPUT -p tcp --dport 21 -m state --state NEW -j ACCEPT\r\n\r\necho \" * allowing dns on port 53 udp\"\r\n${IPTABLES} -A INPUT -p udp -m udp --dport 53 -j ACCEPT\r\n\r\necho \" * allowing dns on port 53 tcp\"\r\n${IPTABLES} -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT\r\n\r\necho \" * allowing http on port 80\"\r\n${IPTABLES} -A INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT\r\n\r\necho \" * allowing https on port 443\"\r\n${IPTABLES} -A INPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT\r\n\r\necho \" * allowing smtp on port 25\"\r\n${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT\r\n\r\necho \" * allowing submission on port 587\"\r\n${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 587 -j ACCEPT\r\n\r\necho \" * allowing imaps on port 993\"\r\n${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 993 -j ACCEPT\r\n\r\necho \" * allowing pop3s on port 995\"\r\n${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 995 -j ACCEPT\r\n\r\necho \" * allowing imap on port 143\"\r\n${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 143 -j ACCEPT\r\n\r\necho \" * allowing pop3 on port 110\"\r\n${IPTABLES} -A INPUT -p tcp -m state --state NEW -m tcp --dport 110 -j ACCEPT\r\n\r\necho \" * allowing ping responses\"\r\n${IPTABLES} -A INPUT -p ICMP --icmp-type 8 -j ACCEPT\r\n\r\n# DROP everything else and Log it\r\n${IPTABLES} -A INPUT -j LOG\r\n${IPTABLES} -A INPUT -j DROP\r\n\r\n#\r\n# Block abusing IPs \r\n# from ${BLACKLIST}\r\n#\r\nif [[ -f \"${BLACKLIST}\" ]] && [[ -s \"${BLACKLIST}\" ]]; then\r\n echo \" * BLOCKING ABUSIVE IPs\"\r\n while read IP; do\r\n ${IPTABLES} -I INPUT -s \"${IP}\" -j DROP\r\n done < <(cat \"${BLACKLIST}\")\r\nfi\r\n\r\n#\r\n# Save settings\r\n#\r\necho \" * SAVING RULES\"\r\n\r\nif [[ -d \/etc\/network\/if-pre-up.d ]]; then\r\n if [[ ! -f \/etc\/network\/if-pre-up.d\/iptables ]]; then\r\n echo -e \"#!\/bin\/bash\" > \/etc\/network\/if-pre-up.d\/iptables\r\n echo -e \"test -e \/etc\/iptables.rules && iptables-restore -c \/etc\/iptables.rules\" >> \/etc\/network\/if-pre-up.d\/iptables\r\n chmod +x \/etc\/network\/if-pre-up.d\/iptables\r\n fi\r\nfi\r\n\r\niptables-save > \/etc\/fwall.rules\r\niptables-restore -c \/etc\/fwall.rules<\/pre>\n
## chmod +x \/usr\/local\/bin\/fwall-rules<\/pre>\n
Applying the Rules<\/h3>\n
fwall-rules<\/code> script and that’s it.<\/p>\n
## fwall-rules\r\n * flushing old rules\r\n * setting default policies\r\n * allowing loopback devices\r\n * allowing ssh on port 5622\r\n * allowing ftp on port 21\r\n * allowing dns on port 53 udp\r\n * allowing dns on port 53 tcp\r\n * allowing http on port 80\r\n * allowing https on port 443\r\n * allowing smtp on port 25\r\n * allowing submission on port 587\r\n * allowing imaps on port 993\r\n * allowing pop3s on port 995\r\n * allowing imap on port 143\r\n * allowing pop3 on port 110\r\n * allowing ping responses\r\n * BLOCKING ABUSIVE IPs\r\n * SAVING RULES<\/pre>\n
\n