3

I am working on Ubuntu 12.04 firewall. I want to deny any IP on runtime. I am using "ufw deny from IP". It's working for future connections. But it is not cancelling the existing connections like ssh.

How can I cancel all the current communication from particular IP?

Regards,

2 Answers 2

3

The best option I've found is to use tcpkill. When I installed it, it was part of the dsniff package, so I had to install that first. Then, you would use it like this :

$ sudo tcpkill ip host 20.129.11.86 and port 22
tcpkill: listening on eth0 [ip host 20.129.11.86 and port 22]
10.206.22.202:42532 > 20.129.11.86:22: R 1785992582:1785992582(0) win 0
10.206.22.202:42532 > 20.129.11.86:22: R 1785992732:1785992732(0) win 0
10.206.22.202:42532 > 20.129.11.86:22: R 1785993032:1785993032(0) win 0
20.129.11.86:22 > 10.206.22.202:42532: R 4065251855:4065251855(0) win 0
20.129.11.86:22 > 10.206.22.202:42532: R 4065301087:4065301087(0) win 0
20.129.11.86:22 > 10.206.22.202:42532: R 4065399551:4065399551(0) win 0

As soon tcpkill detects matching traffic, it will terminate the connection.

To see where else the IP is hitting your system, you can use netstat -aunt and grep for the IP address. E.g.,

$ netstat -aunt | egrep 115.125.
tcp        0      0 10.20.22.25:56156     115.125.225.67:80        ESTABLISHED
tcp        0      0 10.20.22.25:42360     115.125.225.1:80         ESTABLISHED
tcp        0      0 10.20.22.25:35210     115.125.225.64:80        ESTABLISHED

Create further ufw rules if necessary.

Is restarting ssh an option?

You can use sudo /etc/init.d/sshd stop then sudo /etc/init.d/sshd start, or use the service mechanism:

$ sudo service ssh stop
ssh stop/waiting
$ sudo service ssh start
ssh start/running, process 4427

You could drop the interface temporarily, if that's an option.

There's an app called 'cutter' that should work, taking the IP address and port as arguments. However, I wasn't able to get the package to install correctly from

$ sudo apt-get install cutter

It's supposed to work something like this (assuming standard port 22 for ssh):

$ cutter 10.10.10.10 22

You might also check out something like the denyhosts package.

2
  • I tried sudo /etc/init.d/sshd stop but it is not working.. existing ssh connection is still alive..
    – Rashid
    Mar 30, 2013 at 7:52
  • I added some more options. tcpkill worked best in my tests.
    – belacqua
    Apr 2, 2013 at 0:29
-1

I'm not sure, but you can try with iptables:

sudo iptables -A INPUT -p tcp --dport 22 --source 192.168.1.1 -j REJECT

Or if you want to be pedantic

sudo iptables -A INPUT -p tcp --dport 22 --source 192.168.1.1 REJECT --reject-with icmp-host-prohibited

Check this tutorial: https://help.ubuntu.com/community/IptablesHowTo

I hope this helps.

5
  • Please note that, as written, that command is limited to connections to port 22 (which is usually the port on which an SSH server listens). This command could be generalized to block all traffic from that IP address. Mar 28, 2013 at 15:26
  • You should use REJECT rather then DROP See - chiark.greenend.org.uk/~peterb/network/drop-vs-reject
    – Panther
    Mar 28, 2013 at 16:16
  • There are 2 problems with this answer. First you did not describe how to use and save iptables configuarationg and the other problem is that it is not such a good idea to mix iptables and UFW.
    – Panther
    Mar 28, 2013 at 16:26
  • Even "ufw reject from IP" is not working.. the existing ssh and connections are still connected
    – Rashid
    Mar 30, 2013 at 8:45
  • I tried "cutter IP", but it is also not working
    – Rashid
    Mar 30, 2013 at 11:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .