Para bloquear um endereço IP de invasores chamado 1.2.3.4, digite apenas :
$ iptables -A INPUT -s 1.2.3.4 -j DROP
Em um servidor / roteador linux, Eu quero bloquear a porta 80 apenas para um IP (exemplo: 1.2.3.4) Eu tenho dado este exemplo:
### Block Incoming Port Requests (BLOCK PORT)
# To block port 80 only for an ip address 1.2.3.4, enter:
$ iptables -A INPUT -p tcp -s 1.2.3.4 --dport 80 -j DROP
$ iptables -A INPUT -i eth1 -p tcp -s 192.168.1.0/24 --dport 80 -j DROP
Eu acho que apenas a primeira linha é necessária. Eu não entendo o que esta linha faz:
$ iptables -A INPUT -i eth1 -p tcp -s 192.168.1.0/24 --dport 80 -j DROP
Você deve primeiro consultar a página de manual do comando se não entender por que / como funciona. De man iptables :
[!] -p, --protocol protocol
The protocol of the rule or of the packet to check. The specified protocol can be one of tcp, udp, udplite, icmp, esp, ah, sctp or the special keyword "all", or it can be a numeric value, representing one of these protocols or a different one. A protocol name from /etc/protocols is also allowed. A "!" argument before the protocol inverts the test. The number zero is equivalent to all. "all" will match with all protocols and is taken as default when this option is omitted.
[!] -s, --source address[/mask][,...]
Source specification. Address can be either a network name, a hostname, a network IP address (with /mask), or a plain IP address. Hostnames will be resolved once only, before the rule is submitted to the kernel. Please note that specifying any name to be resolved with a remote query such as DNS is a really bad idea. The mask can be either a network mask or a plain number, specifying the number of 1's at the left side of the network mask. Thus, a mask of 24 is equivalent to 255.255.255.0. A "!" argument before the address specification inverts the sense of the address. The flag --src is an alias for this option. Multiple addresses can be specified, but this will expand to multiple rules (when adding with -A), or will cause multiple rules to be deleted (with -D).
-j, --jump target
This specifies the target of the rule; i.e., what to do if the packet matches it. The target can be a user-defined chain (other than the one this rule is in), one of the special builtin targets which decide the fate of the packet immediately, or an extension (see EXTENSIONS below). If this option is omitted in a rule (and -g is not used), then matching the rule will have no effect on the packet's fate, but the counters on the rule will be incremented.
[!] -i, --in-interface name
Name of an interface via which a packet was received (only for packets entering the INPUT, FORWARD and PREROUTING chains). When the "!" argument is used before the interface name, the sense is inverted. If the interface name ends in a "+", then any interface which begins with this name will match. If this option is omitted, any interface name will match.
tcp
These extensions can be used if '--protocol tcp' is specified. It provides the following options: [..]
[!] --destination-port,--dport port[:port]
Destination port or port range specification. The flag --dport is a convenient alias for this option. [..]
Portanto, o comando iptables que você está perguntando diz: 'drop ( -j DROP ) pacotes TCP ( -p tcp ) dos endereços IP 192.168.1.0-192.168.1.255 ( -s 192.168.1.0/24 ) que são direcionados para a porta 80 ( --dport 80 ) neste host ( -A INPUT ) e chegando na interface eth1 ( -i eth1 ). '
Observe que, se o sinalizador -t não for especificado, -t filter estará implícito (isso também é mencionado no manual).
Atualização (com base no comentário do OP):
A linha iptables acima não tem nada a ver com pacotes provenientes do endereço IP 1.2.3.4, e provavelmente deve ser deixada de fora se o servidor / roteador não tiver que bloquear pacotes originados da sub-rede 192.168.1.0/24. / p>
Tags networking iptables linux