0

I'm testing my webapplication which connects to two DBs. I can't stop them but I want to simulate outage of one of them.

So I opened one terminal where I'm pinging DB server:

 ping 172.21.7.188

In the second terminal I did:

sudo iptables -A INPUT -s 172.21.7.188 -j DROP
sudo iptables -A OUTPUT -d 172.21.7.188 -j DROP

But I don't see any change - pings still return. What am I doing wrong?

2 Answers 2

0

While you may be using Ubuntu, this question is not Ubuntu-specific, but Linux-specific, so I think it would be better to ask it on ServerFault.


Answer to the original question (before OP edited it)

Your rule in INPUT chain is correct, but the rule in OUTPUT chain is wrong. You want to drop there packets addressed to the mentioned IP, not the ones coming from it (which is pointless in this chain).

That's why you have to change -s (--source) to -d (--destination) in the rule:

# iptables -A OUTPUT -d 172.21.7.188 -j DROP

But even when you were dropping only incoming packets, it was kind of enough, one could say. It's true that ping was returning (ICMP echo reply was reaching your host) without above line, and consulting tcpdump or wireshark would show ping-related datagrams (i.e. outgoing and incoming), but the ping application wasn't receiving incoming datagrams, because they were dropped.

Obviously it's rather unwise to drop only incoming packets in most of the cases, because it leads to different state on both ends of the connection (at connection level or at application level).


Answer to edited question

If after correction it still doesn't work, then I suspect your firewall has already some rules that make your new rules unreachable. The way you added your rules makes them appended at the end of the chain. You should remove your new rules first (same commands as for appending, but change -A to -D).

Now add your rules to the beginning of chains (i.e. insert them at given rule number 1) they are suited for (same commands as for appending, change -A to -I):

# iptables -I INPUT  -s 172.21.7.188 -j DROP
# iptables -I OUTPUT -d 172.21.7.188 -j DROP

Now it should work.

2
  • Corrected '-s' to '-d'. I can still see pings, though. If this is normal because pings are neither TCP nor UDP than, is there any other way to constantly poll the server and see how it reacts as I update iptables?
    – mnowotka
    Oct 18, 2013 at 13:56
  • Works perfectly now!
    – mnowotka
    Oct 18, 2013 at 14:40
0
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP

This Will Block The Ping

I'm using This Script For Iptables in Our Server's

#!/bin/bash 

#This Script was Used for Only Setting up Iptables in ubuntu 12.04 server
#uncomment the Lines With # Which u don't need to use 
#if u going to use this script in remote VPS Test it in local systems before applying it in remote VPS .
#final line will be commented with # cos it will save the iptables if its not commented with #


#0. Flush every Rules what ever there already 

iptables -F

#1. This enable traffic for (lo) loopback interface(-i) 


iptables -A INPUT -i lo -j ACCEPT


#2. This Will Keep the rules for Which service currently Established  eg : ssh


iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT


#3. This Will Enable the Port Number 22 for ssh which i we have defined 


iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT


#4.This Will Enable the Port Number 80 for http 


iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT


#5.This Will Enable the Port Number 443 for httpd 


iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT


#6. Allow rsync from a specific network


iptables -A INPUT -i eth0 -p tcp --dport 873 -m state --state NEW,ESTABLISHED -j ACCEPT


iptables -A OUTPUT -o eth0 -p tcp --sport 873 -m state --state ESTABLISHED -j ACCEPT


#7. Blow ICMP PING Request 

iptables -A INPUT -p icmp --icmp-type echo-request -j DROP


#11. This Will Block Other connections 


iptables -A INPUT -j DROP



#saving the iptables 


#sudo apt-get install iptables-persistent
#sudo service iptables-persistent save
#sudo service iptables-persistent restart
8
  • But I don't want to block JUST ping. I want to block all connection (IN and OUT from/to all ports) from this machine.
    – mnowotka
    Oct 17, 2013 at 9:29
  • Sorry, I'm not really interested in the script you are using in your company. I'm interested in correct answer to my question. In the comment above I don't see any IP specified so I guess this will block connection from all machines which I don't need.
    – mnowotka
    Oct 17, 2013 at 9:34
  • iptables -A INPUT -j DROP iptables -A OUTPUT -j DROP This Will Block All incoming and Outgoing Dont try it in remote servers , if so you will loose your Connection and cant access any more if its saved .. if not saved u can restart your Remote server and it will rectify from it .. Oct 17, 2013 at 9:34
  • Did u need to block for a particular PC ? Oct 17, 2013 at 9:35
  • Yes - this is clearly stated in my question.
    – mnowotka
    Oct 17, 2013 at 9:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .