Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #2001 > unrolled thread

Dropping connection attempts to port 25

Back to article view | Back to comp.os.linux.networking

Contents

  Dropping connection attempts to port 25 Clark Smith <noaddress@nowhere.net> - 2013-03-11 14:48 +0000
    Re: Dropping connection attempts to port 25 Richard Kettlewell <rjk@greenend.org.uk> - 2013-03-11 14:58 +0000
      Re: Dropping connection attempts to port 25 Clark Smith <noaddress@nowhere.net> - 2013-03-11 15:12 +0000
        Re: Dropping connection attempts to port 25 Richard Kettlewell <rjk@greenend.org.uk> - 2013-03-11 16:24 +0000
        Re: Dropping connection attempts to port 25 Octothorpe <Octothorpe@invalid.com> - 2013-03-11 16:38 -0400
          Re: Dropping connection attempts to port 25 Richard Kettlewell <rjk@greenend.org.uk> - 2013-03-12 10:16 +0000
    Re: Dropping connection attempts to port 25 Dale Dellutri <ddelQQQlutr@panQQQix.com> - 2013-03-11 14:58 +0000
      Re: Dropping connection attempts to port 25 Clark Smith <noaddress@nowhere.net> - 2013-03-11 15:15 +0000
    Re: Dropping connection attempts to port 25 David Hough <noone$$@llondel.org> - 2013-03-12 07:29 +0000
    Re: Dropping connection attempts to port 25 Joe Beanfish <joebeanfish@nospam.duh> - 2013-03-12 13:21 +0000

#2001 — Dropping connection attempts to port 25

	Somebody keeps trying to connect to my sendmail server, without 
success, but filling my logs in the process. Since, according to the 
sendmail logs, the connection seems to be coming from a specific IP 
address <ip>, I added the following IPTables rules:

	iptables -A INPUT -s <ip> -j DROP
	iptables -A OUTPUT -d <ip> -j DROP

However, I can still see further connection attempts in the sendmail logs.

	Any ideas on how to get IPTables to drop such attempts before 
they get to sendmail?

[toc] | [next] | [standalone]

#2002

Clark Smith <noaddress@nowhere.net> writes:
> 	Somebody keeps trying to connect to my sendmail server, without 
> success, but filling my logs in the process. Since, according to the 
> sendmail logs, the connection seems to be coming from a specific IP 
> address <ip>, I added the following IPTables rules:
>
> 	iptables -A INPUT -s <ip> -j DROP
> 	iptables -A OUTPUT -d <ip> -j DROP
>
> However, I can still see further connection attempts in the sendmail logs.
>
> 	Any ideas on how to get IPTables to drop such attempts before 
> they get to sendmail?

Are there any earlier rules in the INPUT or OUTPUT tables?

-- 
http://www.greenend.org.uk/rjk/

[toc] | [prev] | [next] | [standalone]

#2004

On Mon, 11 Mar 2013 14:58:07 +0000, Richard Kettlewell wrote:

> Clark Smith <noaddress@nowhere.net> writes:
>> 	Somebody keeps trying to connect to my sendmail server, without
>> success, but filling my logs in the process. Since, according to the
>> sendmail logs, the connection seems to be coming from a specific IP
>> address <ip>, I added the following IPTables rules:
>>
>> 	iptables -A INPUT -s <ip> -j DROP
>> 	iptables -A OUTPUT -d <ip> -j DROP
>>
>> However, I can still see further connection attempts in the sendmail
>> logs.
>>
>> 	Any ideas on how to get IPTables to drop such attempts before
>> they get to sendmail?
> 
> Are there any earlier rules in the INPUT or OUTPUT tables?

	This was the output from iptable -nvL before adding the rules 
above:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               
destination         
 599K   50M ACCEPT     tcp  --  eth0   *       192.168.0.0/24       
0.0.0.0/0           tcp dpt:22 
 172K   10M            tcp  --  eth0   *       0.0.0.0/0            
0.0.0.0/0           tcp dpt:22 state NEW recent: SET name: DEFAULT side: 
source 
 170K   10M DROP       tcp  --  eth0   *       0.0.0.0/0            
0.0.0.0/0           tcp dpt:22 state NEW recent: UPDATE seconds: 25 
hit_count: 4 name: DEFAULT side: source 

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               
destination         

Chain OUTPUT (policy ACCEPT 8 packets, 1248 bytes)
 pkts bytes target     prot opt in     out     source               
destination 

[toc] | [prev] | [next] | [standalone]

#2007

Clark Smith <noaddress@nowhere.net> writes:
> Richard Kettlewell wrote:
>> Clark Smith <noaddress@nowhere.net> writes:
>>> 	Somebody keeps trying to connect to my sendmail server, without
>>> success, but filling my logs in the process. Since, according to the
>>> sendmail logs, the connection seems to be coming from a specific IP
>>> address <ip>, I added the following IPTables rules:
>>>
>>> 	iptables -A INPUT -s <ip> -j DROP
>>> 	iptables -A OUTPUT -d <ip> -j DROP
>>>
>>> However, I can still see further connection attempts in the sendmail
>>> logs.
>>>
>>> 	Any ideas on how to get IPTables to drop such attempts before
>>> they get to sendmail?
>> 
>> Are there any earlier rules in the INPUT or OUTPUT tables?
>
> 	This was the output from iptable -nvL before adding the rules 
> above:

If you’re quoting iptables output then ‘after’ would be more useful than
‘before’...

-- 
http://www.greenend.org.uk/rjk/

[toc] | [prev] | [next] | [standalone]

#2009

On Mon, 11 Mar 2013 15:12:36 +0000, Clark Smith wrote:

> above:
> 
> Chain INPUT (policy ACCEPT 0 packets, 0 bytes)

It looks like your default policy is to accept....

It should be DROP and you should then add rules to accept the traffic you 
want.

[toc] | [prev] | [next] | [standalone]

#2015

Octothorpe <Octothorpe@invalid.com> writes:
> Clark Smith wrote:

>> above:
>> 
>> Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
>
> It looks like your default policy is to accept....

That won’t stop DROP rules in the chain from working.

> It should be DROP and you should then add rules to accept the traffic
> you want.

That depends what you’re trying to achieve.  

-- 
http://www.greenend.org.uk/rjk/

[toc] | [prev] | [next] | [standalone]

#2003

On Mon, 11 Mar 2013 10:48:29, Clark Smith <noaddress@nowhere.net> wrote:
>         Somebody keeps trying to connect to my sendmail server, without 
> success, but filling my logs in the process. Since, according to the 
> sendmail logs, the connection seems to be coming from a specific IP 
> address <ip>, I added the following IPTables rules:

>         iptables -A INPUT -s <ip> -j DROP
>         iptables -A OUTPUT -d <ip> -j DROP

> However, I can still see further connection attempts in the sendmail logs.

>         Any ideas on how to get IPTables to drop such attempts before 
> they get to sendmail?

Where in the INPUT chain was the first rule added?  Was it after
a rule which accepts port 25 attempts?

Remember that rules are done in order.

To get the order of the rules:
  # iptables -nvL

-- 
Dale Dellutri <ddelQQQlutr@panQQQix.com> (lose the Q's)

[toc] | [prev] | [next] | [standalone]

#2005

On Mon, 11 Mar 2013 14:58:19 +0000, Dale Dellutri wrote:

> On Mon, 11 Mar 2013 10:48:29, Clark Smith <noaddress@nowhere.net> wrote:
>>         Somebody keeps trying to connect to my sendmail server, without
>> success, but filling my logs in the process. Since, according to the
>> sendmail logs, the connection seems to be coming from a specific IP
>> address <ip>, I added the following IPTables rules:
> 
>>         iptables -A INPUT -s <ip> -j DROP
>>         iptables -A OUTPUT -d <ip> -j DROP
> 
>> However, I can still see further connection attempts in the sendmail
>> logs.
> 
>>         Any ideas on how to get IPTables to drop such attempts before
>> they get to sendmail?
> 
> Where in the INPUT chain was the first rule added?  Was it after a rule
> which accepts port 25 attempts?
> 
> Remember that rules are done in order.
> 
> To get the order of the rules:
>   # iptables -nvL

	I added the rules exactly as I described - nothing more, nothing 
less. Am I perhaps missing something?

[toc] | [prev] | [next] | [standalone]

#2014

Clark Smith wrote:

> Somebody keeps trying to connect to my sendmail server, without
> success, but filling my logs in the process. Since, according to the
> sendmail logs, the connection seems to be coming from a specific IP
> address <ip>, I added the following IPTables rules:
> 
> iptables -A INPUT -s <ip> -j DROP
> iptables -A OUTPUT -d <ip> -j DROP
> 
> However, I can still see further connection attempts in the sendmail logs.
> 
> Any ideas on how to get IPTables to drop such attempts before
> they get to sendmail?

Is this a border firewall that is forwarding stuff to other machines on the 
inside, or is it the same machine that's running sendmail? If it's a 
forwarding firewall then you need to be adding the rules to the FORWARD 
table, not the INPUT table.

Dave

[toc] | [prev] | [next] | [standalone]

#2019

On Mon, 11 Mar 2013 14:48:29 +0000, Clark Smith wrote:

> Somebody keeps trying to connect to my sendmail server, without success,
> but filling my logs in the process. Since, according to the sendmail
> logs, the connection seems to be coming from a specific IP address <ip>,
> I added the following IPTables rules:
> 
> 	iptables -A INPUT -s <ip> -j DROP iptables -A OUTPUT -d <ip> -j 
DROP
> 
> However, I can still see further connection attempts in the sendmail
> logs.
> 
> 	Any ideas on how to get IPTables to drop such attempts before
> they get to sendmail?

Try -I instead of -A to ensure your new rule is first and not circumvented
by some later rule.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.os.linux.networking

csiph-web