- Не блокируется IP в IPTABLES, PavelR, 21:16 , 10-Мрт-13 (1)
- Не блокируется IP в IPTABLES, OldDiesel, 12:28 , 11-Мрт-13 (10)
- Не блокируется IP в IPTABLES, LSTemp, 19:22 , 11-Мрт-13 (13)
- Не блокируется IP в IPTABLES, pavlinux, 03:22 , 12-Мрт-13 (15)
- Не блокируется IP в IPTABLES, LSTemp, 04:07 , 13-Мрт-13 (16)
- Не блокируется IP в IPTABLES, LSTemp, 22:47 , 13-Мрт-13 (19)
- Не блокируется IP в IPTABLES, ivankz, 12:31 , 02-Июн-16 (22)
Доброго времени суток!Прошу сильно не пинайте, только начинаю разбираться с iptables... Но тоже проблема, на Mandriva стоит VBox, на Боксе поднят почтовый сервер на Win2008 сервер H-Mail ip 192.185.0.55 Постоянно пытаются ломать. ( IP разные, уже целый список) -------------------------------------------------------------- 3949 15:03:16.618245 vnesh_IP 180.166.46.151 SMTP S: 535 Authentication failed. Too many invalid logon attempts. -------------------------------------------------------------- iptables-save # Generated by iptables-save v1.4.7 on Thu Jun 2 14:49:52 2016 *raw :PREROUTING ACCEPT [1758:231837] :OUTPUT ACCEPT [1456:389798] COMMIT # Completed on Thu Jun 2 14:49:52 2016 # Generated by iptables-save v1.4.7 on Thu Jun 2 14:49:52 2016 *nat :PREROUTING ACCEPT [151:17934] :POSTROUTING ACCEPT [20:1347] :OUTPUT ACCEPT [20:1347] -A PREROUTING -d vnesh_IP -p tcp -m multiport --dports 25 -j DNAT --to-destination 192.185.0.55 -A PREROUTING -d vnesh_IP -p tcp -m multiport --dports 26 -j DNAT --to-destination 192.185.0.55 -A PREROUTING -d vnesh_IP -p tcp -m multiport --dports 80 -j DNAT --to-destination 192.185.0.99 -A POSTROUTING -d 192.185.0.55/32 -p tcp -m multiport --dports 25 -j SNAT --to-source 192.185.0.115 -A POSTROUTING -d 192.185.0.55/32 -p tcp -m multiport --dports 26 -j SNAT --to-source 192.185.0.84 -A POSTROUTING -d 192.185.0.99/32 -p tcp -m multiport --dports 80 -j SNAT --to-source 192.185.0.84 -A OUTPUT -d vnesh_IP -p tcp -m multiport --dports 25 -j DNAT --to-destination 192.185.0.55 -A OUTPUT -d vnesh_IP -p tcp -m multiport --dports 26 -j DNAT --to-destination 192.185.0.55 -A OUTPUT -d vnesh_IP -p tcp -m multiport --dports 80 -j DNAT --to-destination 192.185.0.99 COMMIT # Completed on Thu Jun 2 14:49:52 2016 # Generated by iptables-save v1.4.7 on Thu Jun 2 14:49:52 2016 *mangle :PREROUTING ACCEPT [1758:231837] :INPUT ACCEPT [1445:198515] :FORWARD ACCEPT [252:24954] :OUTPUT ACCEPT [1456:389798] :POSTROUTING ACCEPT [1709:414821] :tcfor - [0:0] :tcout - [0:0] :tcpost - [0:0] :tcpre - [0:0] -A PREROUTING -j tcpre -A FORWARD -j MARK --set-xmark 0x0/0xffffffff -A FORWARD -j tcfor -A OUTPUT -j tcout -A POSTROUTING -j tcpost COMMIT # Completed on Thu Jun 2 14:49:52 2016 # Generated by iptables-save v1.4.7 on Thu Jun 2 14:49:52 2016 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT DROP [0:0] :Drop - [0:0] :Ifw - [0:0] :Reject - [0:0] :dropBcast - [0:0] :dropInvalid - [0:0] :dropNotSyn - [0:0] :dynamic - [0:0] :fw2net - [0:0] :logdrop - [0:0] :logreject - [0:0] :net2fw - [0:0] :reject - [0:0] :shorewall - [0:0] -A INPUT -s 180.166.46.151/32 -j DROP -A INPUT -j Ifw -A INPUT -m conntrack --ctstate INVALID,NEW -j dynamic -A INPUT -i eth2 -j net2fw -A INPUT -i ppp0 -j net2fw -A INPUT -i eth3 -j net2fw -A INPUT -i vboxnet0 -j net2fw -A INPUT -i eth1 -j net2fw -A INPUT -i eth0 -j net2fw -A INPUT -i lo -j ACCEPT -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -j Reject -A INPUT -j LOG --log-prefix "Shorewall:INPUT:REJECT:" --log-level 6 -A INPUT -g reject -A FORWARD -m conntrack --ctstate INVALID,NEW -j dynamic -A FORWARD -i ppp0 -o eth2 -j ACCEPT -A FORWARD -i ppp0 -o eth3 -j ACCEPT -A FORWARD -i ppp0 -o vboxnet0 -j ACCEPT -A FORWARD -i ppp0 -o eth1 -j ACCEPT -A FORWARD -i ppp0 -o eth0 -j ACCEPT -A FORWARD -i eth2 -o ppp0 -j ACCEPT -A FORWARD -i eth2 -o eth3 -j ACCEPT -A FORWARD -i eth2 -o vboxnet0 -j ACCEPT -A FORWARD -i eth2 -o eth1 -j ACCEPT -A FORWARD -i eth2 -o eth0 -j ACCEPT -A FORWARD -i eth3 -o ppp0 -j ACCEPT -A FORWARD -i eth3 -o eth2 -j ACCEPT -A FORWARD -i eth3 -o vboxnet0 -j ACCEPT -A FORWARD -i eth3 -o eth1 -j ACCEPT -A FORWARD -i eth3 -o eth0 -j ACCEPT -A FORWARD -i vboxnet0 -o ppp0 -j ACCEPT -A FORWARD -i vboxnet0 -o eth2 -j ACCEPT -A FORWARD -i vboxnet0 -o eth3 -j ACCEPT -A FORWARD -i vboxnet0 -o eth1 -j ACCEPT -A FORWARD -i vboxnet0 -o eth0 -j ACCEPT -A FORWARD -i eth1 -o ppp0 -j ACCEPT -A FORWARD -i eth1 -o eth2 -j ACCEPT -A FORWARD -i eth1 -o eth3 -j ACCEPT -A FORWARD -i eth1 -o vboxnet0 -j ACCEPT -A FORWARD -i eth1 -o eth0 -j ACCEPT -A FORWARD -i eth0 -o ppp0 -j ACCEPT -A FORWARD -i eth0 -o eth2 -j ACCEPT -A FORWARD -i eth0 -o eth3 -j ACCEPT -A FORWARD -i eth0 -o vboxnet0 -j ACCEPT -A FORWARD -i eth0 -o eth1 -j ACCEPT -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -j Reject -A FORWARD -j LOG --log-prefix "Shorewall:FORWARD:REJECT:" --log-level 6 -A FORWARD -g reject -A OUTPUT -o eth2 -j fw2net -A OUTPUT -o ppp0 -j fw2net -A OUTPUT -o eth3 -j fw2net -A OUTPUT -o vboxnet0 -j fw2net -A OUTPUT -o eth1 -j fw2net -A OUTPUT -o eth0 -j fw2net -A OUTPUT -o lo -j ACCEPT -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A OUTPUT -j Reject -A OUTPUT -j LOG --log-prefix "Shorewall:OUTPUT:REJECT:" --log-level 6 -A OUTPUT -g reject -A Drop -A Drop -p tcp -m tcp --dport 113 -m comment --comment "Auth" -j reject -A Drop -j dropBcast -A Drop -p icmp -m icmp --icmp-type 3/4 -m comment --comment "Needed ICMP types" -j ACCEPT -A Drop -p icmp -m icmp --icmp-type 11 -m comment --comment "Needed ICMP types" -j ACCEPT -A Drop -j dropInvalid -A Drop -p udp -m multiport --dports 135,445 -m comment --comment "SMB" -j DROP -A Drop -p udp -m udp --dport 137:139 -m comment --comment "SMB" -j DROP -A Drop -p udp -m udp --sport 137 --dport 1024:65535 -m comment --comment "SMB" -j DROP -A Drop -p tcp -m multiport --dports 135,139,445 -m comment --comment "SMB" -j DROP -A Drop -p udp -m udp --dport 1900 -m comment --comment "UPnP" -j DROP -A Drop -p tcp -j dropNotSyn -A Drop -p udp -m udp --sport 53 -m comment --comment "Late DNS Replies" -j DROP -A Ifw -m set --match-set ifw_wl src -j RETURN -A Ifw -m set --match-set ifw_bl src -j DROP -A Ifw -m state --state INVALID,NEW -m psd --psd-weight-threshold 10 --psd-delay-threshold 10000 --psd-lo-ports-weight 2 --psd-hi-ports-weight 1 -j IFWLOG --log-prefix "SCAN" -A Ifw -p udp -m state --state NEW -m udp --dport 67 -j IFWLOG --log-prefix "NEW" -A Ifw -p udp -m state --state NEW -m udp --dport 68 -j IFWLOG --log-prefix "NEW" -A Ifw -p tcp -m state --state NEW -m tcp --dport 22 -j IFWLOG --log-prefix "NEW" -A Ifw -p tcp -m state --state NEW -m tcp --dport 25 -j IFWLOG --log-prefix "NEW" -A Ifw -p tcp -m state --state NEW -m tcp --dport 3128 -j IFWLOG --log-prefix "NEW" -A Reject -A Reject -p tcp -m tcp --dport 113 -m comment --comment "Auth" -j reject -A Reject -j dropBcast -A Reject -p icmp -m icmp --icmp-type 3/4 -m comment --comment "Needed ICMP types" -j ACCEPT -A Reject -p icmp -m icmp --icmp-type 11 -m comment --comment "Needed ICMP types" -j ACCEPT -A Reject -j dropInvalid -A Reject -p udp -m multiport --dports 135,445 -m comment --comment "SMB" -j reject -A Reject -p udp -m udp --dport 137:139 -m comment --comment "SMB" -j reject -A Reject -p udp -m udp --sport 137 --dport 1024:65535 -m comment --comment "SMB" -j reject -A Reject -p tcp -m multiport --dports 135,139,445 -m comment --comment "SMB" -j reject -A Reject -p udp -m udp --dport 1900 -m comment --comment "UPnP" -j DROP -A Reject -p tcp -j dropNotSyn -A Reject -p udp -m udp --sport 53 -m comment --comment "Late DNS Replies" -j DROP -A dropBcast -m addrtype --dst-type BROADCAST -j DROP -A dropBcast -d 224.0.0.0/4 -j DROP -A dropInvalid -m conntrack --ctstate INVALID -j DROP -A dropNotSyn -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP -A fw2net -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A fw2net -j ACCEPT -A logdrop -j DROP -A logreject -j reject -A net2fw -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A net2fw -p udp -m multiport --dports 67,68 -j ACCEPT -A net2fw -p tcp -m multiport --dports 22,25,26,3128 -j ACCEPT -A net2fw -j Drop -A net2fw -j LOG --log-prefix "Shorewall:net2fw:DROP:" --log-level 6 -A net2fw -j DROP -A reject -m addrtype --src-type BROADCAST -j DROP -A reject -s 224.0.0.0/4 -j DROP -A reject -p igmp -j DROP -A reject -p tcp -j REJECT --reject-with tcp-reset -A reject -p udp -j REJECT --reject-with icmp-port-unreachable -A reject -p icmp -j REJECT --reject-with icmp-host-unreachable -A reject -j REJECT --reject-with icmp-host-prohibited COMMIT # Completed on Thu Jun 2 14:49:52 2016 --------------------------------------------------------------- ifconfig -a eth0 Link encap:Ethernet HWaddr 20:CF:30:6F:1D:EB inet addr: vnesh_IP Bcast: ***** Mask:255.255.255.252 inet6 addr: *** Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:518530 errors:0 dropped:0 overruns:0 frame:0 TX packets:330634 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:268453626 (256.0 MiB) TX bytes:115566217 (110.2 MiB) Interrupt:18 eth1 Link encap:Ethernet HWaddr 20:CF:30:6F:20:12 inet addr:192.185.0.84 Bcast:192.185.0.255 Mask:255.255.255.0 inet6 addr: *** Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:646844 errors:0 dropped:40 overruns:0 frame:0 TX packets:611546 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:111661464 (106.4 MiB) TX bytes:1234218494 (1.1 GiB) Interrupt:19 eth3 Link encap:Ethernet HWaddr 00:1E:58:9A:21:23 inet addr:192.185.0.115 Bcast:192.185.0.255 Mask:255.255.255.0 inet6 addr: *** Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:151730 errors:0 dropped:0 overruns:0 frame:0 TX packets:403 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:50372794 (48.0 MiB) TX bytes:36529 (35.6 KiB) Interrupt:22 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:259 errors:0 dropped:0 overruns:0 frame:0 TX packets:259 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:15736 (15.3 KiB) TX bytes:15736 (15.3 KiB) vboxnet0 Link encap:Ethernet HWaddr 0A:00:27:00:00:00 BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) ---------------------------------------------------------------------- route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface vnesh_IP 0.0.0.0 255.255.255.252 U 1 0 0 eth0 192.185.0.0 0.0.0.0 255.255.255.0 U 3 0 0 eth1 192.185.0.0 0.0.0.0 255.255.255.0 U 5 0 0 eth3 169.254.0.0 0.0.0.0 255.255.0.0 U 1 0 0 eth0 169.254.0.0 0.0.0.0 255.255.0.0 U 3 0 0 eth1 169.254.0.0 0.0.0.0 255.255.0.0 U 5 0 0 eth3 0.0.0.0 vnesh_GOV 0.0.0.0 UG 1 0 0 eth0 0.0.0.0 192.185.0.84 0.0.0.0 UG 3 0 0 eth1 ну и может пригодиться ---------------------------------------------------------------------------------- iptables -S -P INPUT DROP -P FORWARD DROP -P OUTPUT DROP -N Drop -N Ifw -N Reject -N dropBcast -N dropInvalid -N dropNotSyn -N dynamic -N fail2ban-SSH -N fail2ban-dovecot -N fw2net -N logdrop -N logreject -N net2fw -N reject -N shorewall -A INPUT -p tcp -m multiport --dports 22,80,443,25,465,110,995,143,993,4190 -j fail2ban-dovecot -A INPUT -s 180.166.46.151/32 -j DROP -A INPUT -j Ifw -A INPUT -m conntrack --ctstate INVALID,NEW -j dynamic -A INPUT -i eth2 -j net2fw -A INPUT -i ppp0 -j net2fw -A INPUT -i eth3 -j net2fw -A INPUT -i vboxnet0 -j net2fw -A INPUT -i eth1 -j net2fw -A INPUT -i eth0 -j net2fw -A INPUT -i lo -j ACCEPT -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -j Reject -A INPUT -j LOG --log-prefix "Shorewall:INPUT:REJECT:" --log-level 6 -A INPUT -g reject -A FORWARD -m conntrack --ctstate INVALID,NEW -j dynamic -A FORWARD -i ppp0 -o eth2 -j ACCEPT -A FORWARD -i ppp0 -o eth3 -j ACCEPT -A FORWARD -i ppp0 -o vboxnet0 -j ACCEPT -A FORWARD -i ppp0 -o eth1 -j ACCEPT -A FORWARD -i ppp0 -o eth0 -j ACCEPT -A FORWARD -i eth2 -o ppp0 -j ACCEPT -A FORWARD -i eth2 -o eth3 -j ACCEPT -A FORWARD -i eth2 -o vboxnet0 -j ACCEPT -A FORWARD -i eth2 -o eth1 -j ACCEPT -A FORWARD -i eth2 -o eth0 -j ACCEPT -A FORWARD -i eth3 -o ppp0 -j ACCEPT -A FORWARD -i eth3 -o eth2 -j ACCEPT -A FORWARD -i eth3 -o vboxnet0 -j ACCEPT -A FORWARD -i eth3 -o eth1 -j ACCEPT -A FORWARD -i eth3 -o eth0 -j ACCEPT -A FORWARD -i vboxnet0 -o ppp0 -j ACCEPT -A FORWARD -i vboxnet0 -o eth2 -j ACCEPT -A FORWARD -i vboxnet0 -o eth3 -j ACCEPT -A FORWARD -i vboxnet0 -o eth1 -j ACCEPT -A FORWARD -i vboxnet0 -o eth0 -j ACCEPT -A FORWARD -i eth1 -o ppp0 -j ACCEPT -A FORWARD -i eth1 -o eth2 -j ACCEPT -A FORWARD -i eth1 -o eth3 -j ACCEPT -A FORWARD -i eth1 -o vboxnet0 -j ACCEPT -A FORWARD -i eth1 -o eth0 -j ACCEPT -A FORWARD -i eth0 -o ppp0 -j ACCEPT -A FORWARD -i eth0 -o eth2 -j ACCEPT -A FORWARD -i eth0 -o eth3 -j ACCEPT -A FORWARD -i eth0 -o vboxnet0 -j ACCEPT -A FORWARD -i eth0 -o eth1 -j ACCEPT -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -j Reject -A FORWARD -j LOG --log-prefix "Shorewall:FORWARD:REJECT:" --log-level 6 -A FORWARD -g reject -A OUTPUT -o eth2 -j fw2net -A OUTPUT -o ppp0 -j fw2net -A OUTPUT -o eth3 -j fw2net -A OUTPUT -o vboxnet0 -j fw2net -A OUTPUT -o eth1 -j fw2net -A OUTPUT -o eth0 -j fw2net -A OUTPUT -o lo -j ACCEPT -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A OUTPUT -j Reject -A OUTPUT -j LOG --log-prefix "Shorewall:OUTPUT:REJECT:" --log-level 6 -A OUTPUT -g reject -A Drop -A Drop -p tcp -m tcp --dport 113 -m comment --comment "Auth" -j reject -A Drop -j dropBcast -A Drop -p icmp -m icmp --icmp-type 3/4 -m comment --comment "Needed ICMP types" -j ACCEPT -A Drop -p icmp -m icmp --icmp-type 11 -m comment --comment "Needed ICMP types" -j ACCEPT -A Drop -j dropInvalid -A Drop -p udp -m multiport --dports 135,445 -m comment --comment "SMB" -j DROP -A Drop -p udp -m udp --dport 137:139 -m comment --comment "SMB" -j DROP -A Drop -p udp -m udp --sport 137 --dport 1024:65535 -m comment --comment "SMB" -j DROP -A Drop -p tcp -m multiport --dports 135,139,445 -m comment --comment "SMB" -j DROP -A Drop -p udp -m udp --dport 1900 -m comment --comment "UPnP" -j DROP -A Drop -p tcp -j dropNotSyn -A Drop -p udp -m udp --sport 53 -m comment --comment "Late DNS Replies" -j DROP -A Ifw -m set --match-set ifw_wl src -j RETURN -A Ifw -m set --match-set ifw_bl src -j DROP -A Ifw -m state --state INVALID,NEW -m psd --psd-weight-threshold 10 --psd-delay-threshold 10000 --psd-lo-ports-weight 2 --psd-hi-ports-weight 1 -j IFWLOG --log-prefix "SCAN" -A Ifw -p udp -m state --state NEW -m udp --dport 67 -j IFWLOG --log-prefix "NEW" -A Ifw -p udp -m state --state NEW -m udp --dport 68 -j IFWLOG --log-prefix "NEW" -A Ifw -p tcp -m state --state NEW -m tcp --dport 22 -j IFWLOG --log-prefix "NEW" -A Ifw -p tcp -m state --state NEW -m tcp --dport 25 -j IFWLOG --log-prefix "NEW" -A Ifw -p tcp -m state --state NEW -m tcp --dport 3128 -j IFWLOG --log-prefix "NEW" -A Reject -A Reject -p tcp -m tcp --dport 113 -m comment --comment "Auth" -j reject -A Reject -j dropBcast -A Reject -p icmp -m icmp --icmp-type 3/4 -m comment --comment "Needed ICMP types" -j ACCEPT -A Reject -p icmp -m icmp --icmp-type 11 -m comment --comment "Needed ICMP types" -j ACCEPT -A Reject -j dropInvalid -A Reject -p udp -m multiport --dports 135,445 -m comment --comment "SMB" -j reject -A Reject -p udp -m udp --dport 137:139 -m comment --comment "SMB" -j reject -A Reject -p udp -m udp --sport 137 --dport 1024:65535 -m comment --comment "SMB" -j reject -A Reject -p tcp -m multiport --dports 135,139,445 -m comment --comment "SMB" -j reject -A Reject -p udp -m udp --dport 1900 -m comment --comment "UPnP" -j DROP -A Reject -p tcp -j dropNotSyn -A Reject -p udp -m udp --sport 53 -m comment --comment "Late DNS Replies" -j DROP -A dropBcast -m addrtype --dst-type BROADCAST -j DROP -A dropBcast -d 224.0.0.0/4 -j DROP -A dropInvalid -m conntrack --ctstate INVALID -j DROP -A dropNotSyn -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP -A fail2ban-SSH -j RETURN -A fail2ban-dovecot -j RETURN -A fw2net -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A fw2net -j ACCEPT -A logdrop -j DROP -A logreject -j reject -A net2fw -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A net2fw -p udp -m multiport --dports 67,68 -j ACCEPT -A net2fw -p tcp -m multiport --dports 22,25,26,3128 -j ACCEPT -A net2fw -j Drop -A net2fw -j LOG --log-prefix "Shorewall:net2fw:DROP:" --log-level 6 -A net2fw -j DROP -A reject -m addrtype --src-type BROADCAST -j DROP -A reject -s 224.0.0.0/4 -j DROP -A reject -p igmp -j DROP -A reject -p tcp -j REJECT --reject-with tcp-reset -A reject -p udp -j REJECT --reject-with icmp-port-unreachable -A reject -p icmp -j REJECT --reject-with icmp-host-unreachable -A reject -j REJECT --reject-with icmp-host-prohibited подскажите куда копать?
|