iptables to block range of ip

[Otto Rodusek]

Hi,

I'm using RT-AC88U_380.67_beta3.trx on RT-AC88U.

I issued the following iptables commands:

iptables -A INPUT -s 183.136.184.0/24 -j DROP
iptables -A INPUT -s 54.0.0.0/8 -j DROP
iptables -A INPUT -s 45.0.0.0/8 -j DROP

I checked with iptables -L and indeed the rules are there - however - when I check my syslog - the ip was ACCEPTED:

Jul 10 20:13:16 kernel: ACCEPT IN=eth0 OUT= MAC=60:45:cb:b1:d9:68:00:00:5e:00:01:99:08:00 SRC=54.183.102.24 DST=192.168.5.254 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=41715 DF PROTO=TCP SPT=55682 DPT=10443 SEQ=3377093481 ACK=0 WINDOW=29200 RES=0x00 SYN URGP=0 OPT (020405B40402080A20ADF99A0000000001030307)


Is there a different way to block a range of ip on busybox v1.25?

Thanks for any help.

 

[Adamm]

Hi,

I'm using RT-AC88U_380.67_beta3.trx on RT-AC88U.

I issued the following iptables commands:

iptables -A INPUT -s 183.136.184.0/24 -j DROP
iptables -A INPUT -s 54.0.0.0/8 -j DROP
iptables -A INPUT -s 45.0.0.0/8 -j DROP

I checked with iptables -L and indeed the rules are there - however - when I check my syslog - the ip was ACCEPTED:

Jul 10 20:13:16 kernel: ACCEPT IN=eth0 OUT= MAC=60:45:cb:b1:d9:68:00:00:5e:00:01:99:08:00 SRC=54.183.102.24 DST=192.168.5.254 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=41715 DF PROTO=TCP SPT=55682 DPT=10443 SEQ=3377093481 ACK=0 WINDOW=29200 RES=0x00 SYN URGP=0 OPT (020405B40402080A20ADF99A0000000001030307)


Is there a different way to block a range of ip on busybox v1.25?

Thanks for any help.

You are appending the rules to the end of the chain ( -A ) not inserting them to the top ( -I ).

IPTables works on a "first match" basis, so it is being matched and accepted by other rules before getting to that rule. To fix this use -I instead

 

[Martineau]

Hi,

I'm using RT-AC88U_380.67_beta3.trx on RT-AC88U.

I issued the following iptables commands:

iptables -A INPUT -s 183.136.184.0/24 -j DROP
iptables -A INPUT -s 54.0.0.0/8 -j DROP
iptables -A INPUT -s 45.0.0.0/8 -j DROP

I checked with iptables -L and indeed the rules are there - however - when I check my syslog - the ip was ACCEPTED:

Jul 10 20:13:16 kernel: ACCEPT IN=eth0 OUT= MAC=60:45:cb:b1:d9:68:00:00:5e:00:01:99:08:00 SRC=54.183.102.24 DST=192.168.5.254 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=41715 DF PROTO=TCP SPT=55682 DPT=10443 SEQ=3377093481 ACK=0 WINDOW=29200 RES=0x00 SYN URGP=0 OPT (020405B40402080A20ADF99A0000000001030307)


Is there a different way to block a range of ip on busybox v1.25?

Thanks for any help.

Try the FORWARD chain rather than the INPUT chain.

 

[Otto Rodusek]

Hi,

Yup using (-I) instead of (-A) did the trick! I'm so used to using (-A) that I completely forgot about (-I)! Again thanks for the quick reply and fix!