On 6/26/19 8:41 AM, MRob wrote:
I am working to a CentOS 6 server with nonstandard iptables system without rule
for ACCEPT ESTABLISHED connections. All tables and chains empty (flush by
legacy custom script) so only filter/INPUT chain has rules (also fail2ban
chain):
Chain INPUT (policy ACCEPT)
target prot opt source destination
f2b-postfix tcp -- 0.0.0.0/0 0.0.0.0/0
[...]
Chain f2b-postfix (1 references)
target prot opt source destination
REJECT all -- 200.23.235.30 0.0.0.0/0 reject-with
icmp-port-unreachable
REJECT all -- 177.11.167.57 0.0.0.0/0 reject-with
icmp-port-unreachable
RETURN all -- 0.0.0.0/0 0.0.0.0/0
[...]
When fail2ban block a IP address, established connections are allowed to
continue, but with no rule to accept established connections how is that
possible? Why doesn't f2b first rule block established connections?
The first rule should indeed block traffic for the established connections too.
It matches tcp only, are your connections really on tcp (and ipv4)?
Try adding the "-v" option to iptables so you can see the packet counters.
Do some experiments and check if the counters grow or not
when you expect packets to be dropped.
Regards.
--
Roberto Ragusa mail at robertoragusa.it
_______________________________________________
CentOS mailing list
CentOS@centos.org
https://lists.centos.org/mailman/listinfo/centos
