Question on IPtables

Discussion in 'Security' started by Jeffr2014, Apr 10, 2015.

  1. #1
    How can I remove a record from IPtables? I was blocking PaperLiBot (got 80+ hits in 10 hours) and initially I blocked 2 C classes below:
    DROP all -- 37.187.162.0/24 anywhere
    DROP all -- 37.187.165.0/24 anywhere

    Then I had a close look at IPs and realized that I need to block 8 C classes, so I added
    DROP all -- 37.187.160.0/21 anywhere

    I assumed that my last action will erase previous 2 records from IP tables as they are nested in this 8-range. Apparently not, when I run iptables -L I see all 3 lines there. How can I remove the first 2 records as they are unnecessary?
     
    Solved! View solution.
    Jeffr2014, Apr 10, 2015 IP
  2. Kingfish85

    Kingfish85 Well-Known Member

    Messages:
    71
    Likes Received:
    6
    Best Answers:
    0
    Trophy Points:
    125
    #2
    you can edit the config directly: /etc/sysconfig/iptables
     
    Kingfish85, Apr 10, 2015 IP
  3. #3
    PoPSiCLe, Apr 11, 2015 IP
  4. Jeffr2014

    Jeffr2014 Active Member

    Messages:
    254
    Likes Received:
    18
    Best Answers:
    0
    Trophy Points:
    55
    #4
    Great, thanks. In case somebody else is trying to do this, here is how (based on the answer from @popsicle with some info from post comments).

    Run command: iptables -vnL --line-numbers | grep "IP_ADDRESS", in my case IP_ADDRESS was "37.187.16"

    You get back something like:
    66 DROP all -- 37.187.162.0/24 anywhere
    67 DROP all -- 37.187.165.0/24 anywhere
    68 DROP all -- 37.187.160.0/21 anywhere

    In my case I want to delete lines 66, 67 but have to remember that 67 will become 66 after delete the first line.
    So I had to run this twice: iptables -D INPUT 66
     
    Jeffr2014, Apr 11, 2015 IP
  5. PoPSiCLe

    PoPSiCLe Illustrious Member

    Messages:
    4,623
    Likes Received:
    725
    Best Answers:
    152
    Trophy Points:
    470
    #5
    Or you just start at the bottom ;) (ie, first 68, then 67, then 66)
     
    PoPSiCLe, Apr 11, 2015 IP