On 4/23/06, Devon Harding <devonharding@xxxxxxxxx> wrote:
The reason I want the chains saved, is because I'm uning sshdblackd (http://www.sshblack.com) to block failed ssh attempts on my box Here is everything that I did manually... [root@mars ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT all -- anywhere anywhere BLACKLIST tcp -- anywhere anywhere tcp dpt:ssh Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain BLACKLIST (1 references) target prot opt source destination DROP all -- uo82.internetdsl.tpnet.pl anywhere [root@mars ~]# cat /etc/cron.hourly/iptables.cron #!/bin/sh /sbin/iptables-save >/dev/null 2>&1 [root@mars ~]# /sbin/iptables-save # Generated by iptables-save v1.3.5 on Sun Apr 23 09:24:51 2006 *filter :INPUT ACCEPT [19025:2595521] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [691823:184550717] :BLACKLIST - [0:0] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -j BLACKLIST -A BLACKLIST -s 80.55.144.82 -j DROP COMMIT # Completed on Sun Apr 23 09:24:51 2006 [root@mars ~]# cat /etc/sysconfig/iptables # Generated by iptables-save v1.3.5 on Sun Apr 23 09:01:15 2006 *filter :INPUT ACCEPT [18650:2543690] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [690115:184341112] :BLACKLIST - [0:0] [664430:180357913] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT [3365:200808] -A INPUT -i lo -j ACCEPT [6:360] -A INPUT -p tcp -m tcp --dport 22 -j BLACKLIST [3:180] -A BLACKLIST -s 80.55.144.82 -j DROP COMMIT # Completed on Sun Apr 23 09:01:15 2006 [root@mars ~]# reboot Broadcast message from root (pts/0) (Sun Apr 23 09:25:40 2006): The system is going down for reboot NOW! [root@mars ~]# Last login: Sun Apr 23 09:20:19 2006 from pluto.domain.com [root@mars ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination [root@mars ~]#
This is everything i've tried...
