UNIX for Dummies Questions & Answers

Fedora C2
Apcache 2.0

Right now my setup consists of a cable modem which connects to a wireless router (Linksys WRT54G), which I have port forward all port 80 requests to my Linux (Fedora) box.

I want to block a certain ip address that has been in my /etc/httpd/logs/access_log file with entries like this:

67.173.189.150 - - [25/Sep/2004:11:28:24 -0500] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 "-" "-"

When I look at the logs, it's the same IP everytime, and it fills up my log file pretty good.

Now i have tried to use iptables to stop this, but they still show up. Here is the command I use, and I enter it into /etc/rc.local so that it will execute on reboot:

iptables -A INPUT -i eth0 -p tcp -s 67.173.189.150 -j DROP


Is there something that I'm missing? I seem to think that my iptables command may not be correct with having a router port fowarding port 80 requests.

Also, does it matter that I have ip6tables and iptables both?

Thanks,
Jeff

I would leave out that -i eth0.

Then it'll drop those packets whatever interface they happen to be wandering in through.

ip6tables(or what) is used with IPv6
probably not applicable.

Thanks for the reply. I did figure out the problem. My problem was that I had a chain that was executing before my manual changes. And this chain had an accept all for port 80.

Once I changed the order, I was golden. No more log entries.