Trying to ban an entire subset with ufw but failing to do so

graysky · 2016-07-19 01:21:19

I'm running ufw and want to ban 184.105.*.* so I entered:

# ufw deny from 184.105.0.0/16

Yet, I still have incoming pings from these... what am I missing?

ewaller · 2016-07-19 02:09:03

Hey graysky, I know little of UFW, but, remember that "pings"(ICMP Level junk) are at a much lower level than are TCP and UDP (Transport Layer junk).
It might be that what you are doing drops the high level stuff, but the system still responds to the low level stuff. Of course, I could be completely wrong

loafer · 2016-07-19 05:08:56

From memory you need to put these type of rules - for stuff like icmp - in a file called before.rules (it's a while since I used ufw to be honest).

graysky · 2016-07-19 06:19:54

I should have clarified: "pings" in this context means someone in hitting my https server and I want to ban them permanently from connecting... so it's not a real ping (poor choice of words):

From /var/log/httpd/access_log

184.105.247.196 - - [16/Jul/2016:09:12:12 -0400] "GET / HTTP/1.1" 403 1006
...
74.82.47.4 - - [17/Jul/2016:11:23:23 -0400] "GET / HTTP/1.1" 403 1006

Last edited by graysky (2016-07-19 06:20:34)

loafer · 2016-07-19 10:33:19

What order does ufw add new rules in? Does it insert or append? If you have a rule to allow connections before the above deny rule could it be taking precedence?

graysky · 2016-07-19 12:35:59

Not sure... I did set it up via the wiki where the first line I entered was:

ufw default deny

loafer · 2016-07-20 04:51:48

If you list all of the rules doesn't that give an idea? ufw must have a way of checking/listing what is being applied and how. In fact "iptables-save" probably gives a better idea.

graysky · 2016-07-20 06:18:30

loafer wrote:

What order does ufw add new rules in? Does it insert or append? If you have a rule to allow connections before the above deny rule could it be taking precedence?

loafer wrote:

If you list all of the rules doesn't that give an idea? ufw must have a way of checking/listing what is being applied and how. In fact "iptables-save" probably gives a better idea.

The odd thing is that `ufw status` does give a list but the order of the list does not correspond to the order in which entered the rules...

# ufw status
Status: active

To                         Action      From
--                         ------      ----
Anywhere                   ALLOW       192.168.1.0/24            
22                         ALLOW       Anywhere 
WWW Secure                 ALLOW       Anywhere                  
sshd2                      ALLOW       Anywhere                  
Anywhere                   DENY        184.105.0.0/16
Anywhere                   DENY        74.82.0.0/16
WWW Secure (v6)            ALLOW       Anywhere (v6)             
sshd2 (v6)                 ALLOW       Anywhere (v6)

# iptables-save


# Generated by iptables-save v1.6.0 on Wed Jul 20 02:15:11 2016
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
...

<< all the standard ufw stuff >>

...
-A ufw-user-input -s 192.168.1.0/24 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 22 -j ACCEPT
-A ufw-user-input -p udp -m udp --dport 22 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 443 -m comment --comment "\'dapp_WWW%20Secure\'" -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 20101 -m comment --comment "\'dapp_sshd2\'" -j ACCEPT
-A ufw-user-input -s 184.105.0.0/16 -j DROP
-A ufw-user-input -s 74.82.0.0/16 -j DROP
-A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] "
-A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable
-A ufw-user-limit-accept -j ACCEPT
COMMIT
# Completed on Wed Jul 20 02:15:11 2016

So the accept for 443 does come before the drop for the two IP masks to ban. Is the order for that correct or should they be reversed? I can reorder them in /etc/ufw/user.rules ... seems like a bug in ufw if so.

Last edited by graysky (2016-07-20 06:41:14)

R00KIE · 2016-07-20 08:38:08

Rules are evaluated in the order as they appear in iptables, so if you want to drop something you have to put it before the accept line.

As a side note, if you are planning on banning a large number of IPs you might want to check if what you are planning to use supports ipset.

graysky · 2016-07-20 09:28:40

R00KIE wrote:

Rules are evaluated in the order as they appear in iptables, so if you want to drop something you have to put it before the accept line.
As a side note, if you are planning on banning a large number of IPs you might want to check if what you are planning to use supports ipset.

Thought so from what I found in google. For now, I just manually reordered them in user.rules. To your 2nd point, I have been just looking through the httpd access log and banning IP addresses that I do not recognize as they have no need to hit the server. I'm not sure what you mean by the comment you made about ipset...?

R00KIE · 2016-07-20 09:56:30

That was just an idea, it doesn't mean you really have to use it, think of it as another option if later you want to try doing things differently for some reason.

I suppose ipset is more "natural" to use if you use iptables directly but if you are curious you can take a quick look here [1] and get an idea on how it works

[1] https://wiki.archlinux.org/index.php/Ipset

Arch Linux

#1 2016-07-19 01:21:19

Trying to ban an entire subset with ufw but failing to do so

#2 2016-07-19 02:09:03

Re: Trying to ban an entire subset with ufw but failing to do so

#3 2016-07-19 05:08:56

Re: Trying to ban an entire subset with ufw but failing to do so

#4 2016-07-19 06:19:54

Re: Trying to ban an entire subset with ufw but failing to do so

#5 2016-07-19 10:33:19

Re: Trying to ban an entire subset with ufw but failing to do so

#6 2016-07-19 12:35:59

Re: Trying to ban an entire subset with ufw but failing to do so

#7 2016-07-20 04:51:48

Re: Trying to ban an entire subset with ufw but failing to do so

#8 2016-07-20 06:18:30

Re: Trying to ban an entire subset with ufw but failing to do so

#9 2016-07-20 08:38:08

Re: Trying to ban an entire subset with ufw but failing to do so

#10 2016-07-20 09:28:40

Re: Trying to ban an entire subset with ufw but failing to do so

#11 2016-07-20 09:56:30

Re: Trying to ban an entire subset with ufw but failing to do so

Board footer