Login or Register to Ask a Question and Join Our Community


Emergency UNIX and Linux Support

Firewall rule for multiport not getting deleted

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Homework and Emergencies Emergency UNIX and Linux Support Firewall rule for multiport not getting deleted
# 1  
Old 12-18-2012
Firewall rule for multiport not getting deleted
The REJECT rule in iptables is as shown below

/etc/sysconfig/iptables>>
Code:
-A INPUT -s 10.110.110.52 -d 10.110.110.53 -p tcp -m tcp --dport 7800 -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -s 10.110.110.53 -d 10.110.110.52 -p tcp -m tcp --dport 7800 -j REJECT --reject-with icmp-port-unreachable

[/CODE]
in the scripts i am using, commands to create and delte firewall as below

DeleteFirewall.sh>>
Code:
 
/sbin/iptables -D OUTPUT -p tcp --dport 7800 -s ${myip}/32 -d ${peerip}/32 -j REJECT
/sbin/iptables -D OUTPUT -p tcp --sport 7800 -s ${myip}/32 -d ${peerip}/32 -j REJECT
 
/sbin/iptables -D OUTPUT -p tcp --dport 7800 -s ${myip}/32 -d ${peerip}/32 -j REJECT
/sbin/iptables -D OUTPUT -p tcp --sport 7800 -s ${myip}/32 -d ${peerip}/32 -j REJECT

Createfirewall.sh>>
Code:
 
/sbin/iptables -I INPUT -p tcp --dport 7800 -s ${peerip}/32 -d ${myip}/32 -j REJECT
/sbin/iptables -I INPUT -p tcp --sport 7800 -s ${peerip}/32 -d ${myip}/32 -j REJECT
 
/sbin/iptables -I OUTPUT -p tcp --dport 7800 -s ${myip}/32 -d ${peerip}/32 -j REJECT
/sbin/iptables -I OUTPUT -p tcp --sport 7800 -s ${myip}/32 -d ${peerip}/32 -j REJECT

DisArmServer.sh>>
Code:
 
/sbin/iptables -I INPUT 1 -p tcp --sport ${JPORT} -s ${peerip}/32 -d ${myip}/32 -j REJECT
if [ ! -z $JPORT  ]; then
  /sbin/iptables -I INPUT 1 -p udp -m multiport --source-port ${JPORT} -s ${peerip}/32 -d ${myip}/32 -j DROP
  /sbin/iptables -I INPUT 1 -p udp -m multiport --destination-port ${JPORT} -s ${peerip}/32 -d ${myip}/32 -j DROP
fi

/sbin/iptables -I OUTPUT 1 -p tcp --sport ${JPORT} -s ${myip}/32 -d ${peerip}/32 -j REJECT
if [ ! -z $JPORT ]; then
  /sbin/iptables -I OUTPUT 1 -p udp -m multiport --source-port ${JPORT} -s ${myip}/32 -d ${peerip} -j DROP
  /sbin/iptables -I OUTPUT 1 -p udp -m multiport --destination-port ${JPORT} -s ${myip}/32 -d ${peerip} -j DROP
fi

ReArm.sh>>
Code:
/sbin/iptables -D INPUT -p tcp --sport ${JPORT} -s ${peerip}/32 -d ${myip}/32 -j REJECT
 
if [ ! -z $JPORT  ]; then
  logger -s -p info "${SCRIPT_NAME}: Running iptables command: /sbin/iptables -D INPUT -p udp -m multiport  \
                --source-port ${ODPORT},${OEPORT},${JPORT} -s ${peerip}/32 -d ${myip}/32 -j DROP"
  /sbin/iptables -D INPUT -p udp -m multiport --source-port ${JPORT} -s ${peerip}/32 -d ${myip}/32 -j DROP
        /sbin/iptables -D INPUT -p udp -m multiport --destination-port ${JPORT} -s ${peerip}/32 -d ${myip}/32 -j DROP
fi

/sbin/iptables -D OUTPUT -p tcp --dport ${JPORT} -s ${myip}/32 -d ${peerip}/32 -j REJECT
if [ ! -z $JPORT ]; then
  /sbin/iptables -D OUTPUT -p udp -m multiport --source-port ${JPORT} -s ${myip}/32 -d ${peerip} -j DROP
  /sbin/iptables -D OUTPUT -p udp -m multiport --destination-port ${JPORT} -s ${myip}/32 -d ${peerip} -j DROP
fi

deleteJBCacheFirewall.sh>>
Code:
/sbin/iptables -D INPUT -p tcp --sport ${JPORT} -s ${peerip}/32 -d ${myip}/32 -j REJECT
/sbin/iptables -D OUTPUT -p tcp --sport ${JPORT} -s ${myip}/32 -d ${peerip}/32 -j REJECT
 
/sbin/iptables -D INPUT -p udp -m multiport --source-port ${ODPORT},${OEPORT},${JPORT} -s ${peerip}/32 -d ${myip}/32 -j DROP
/sbin/iptables -D INPUT -p udp -m multiport --destination-port ${ODPORT},${OEPORT},${JPORT} -s ${peerip}/32 -d ${myip}/32 -j DROP
 
/sbin/iptables -D OUTPUT -p udp -m multiport --source-port ${ODPORT},${OEPORT},${JPORT} -s ${myip}/32 -d ${peerip} -j DROP
/sbin/iptables -D OUTPUT -p udp -m multiport --destination-port ${ODPORT},${OEPORT},${JPORT} -s ${myip}/32 -d ${peerip} -j DROP

but none of these scripts written to remove this rule is removing it..

Code:
iptables -L -n | grep "7800"REJECT     tcp  --  10.110.110.52        
                       10.110.110.53       tcp dpt:7800 reject-with icmp-port-unreachable
REJECT     tcp  --  10.110.110.53        
                     10.110.110.52        tcp dpt:7800 reject-with icmp-port-unreachable



and even when creating the rule we are using UDP for multiport but in iptables the rule is shown as multiprt for TCP(p tcp -m tcp --dport )... i am not able to understand where it came form.. any help will be deeply appreciated... :-(
Last edited by Scott; 12-18-2012 at 01:02 PM.. Reason: Removed formatting
# 2  
Old 12-19-2012
Shouldn't delete reference input and output not output twice?
This User Gave Thanks to DGPickett For This Post:
vivek d r
Login or Register to Ask a Question

Previous Thread | Next Thread

5 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

iptables rule to block access from VM Browser to Firewall Login Page

(1 Reply)
Discussion started by: senrabdet
1 Replies

2. Web Development

Need help with rewrite rule

Hi, I hosted my site on Apache web server. I wanted to redirect all the users request to a HTML page(maintenance page). I used the below rewrite rule to do ths same. RewriteEngine on RewriteRule .* /maintenance.html The maintenance.html page contains an image. When ever I try to... (2 Replies)
Discussion started by: BSrikanthB
2 Replies

3. Linux

IPtable rule help need

Hi, I need to configure iptable such that whatever request comes to 192.168.0.4 needs to forwarded to 192.168.0.50 and only port 80 and 443 needs to be forwarded others need to be blocked.... Thanks gr8 forum:) (1 Reply)
Discussion started by: iron_michael86
1 Replies

4. Post Here to Contact Site Administrators and Moderators

Rule # 8

In light of this board's rule stating "no BSD vs. Linux vs. Windows or similar threads," is the following post legal (can I post it)? Hi. I'm thinking about obtaining a web server for business purposes and I want to learn to administer and maintain the server myself. I need to be able to use... (1 Reply)
Discussion started by: bluegospel
1 Replies

5. Email Antispam Techniques and Email Filtering

procmail rule

I can tell this is not a recently active formum, but here goes, "why doesn't this procmail rule block messages with víagra or v1agra appearing in the subject header :0 * ^Subject:.*(víagra¦v1agra¦pénis¦prescripti0n¦Medicati0n¦M0rtgage¦Xanaxz) { LOG="(THE 7 DIRTY WORDS) " :0 ... (4 Replies)
Discussion started by: jones
4 Replies
Login or Register to Ask a Question