Iptables – How to add iptables ip blocklists to Plesk 10.4.4 (CentOS)

.htaccessblacklistip-blockingiptables

I'm trying to figure out the best way to add IP blocklists to my Plesk 10.4.4 server (CentOS). It's a simple Virtual Server I recently acquired through my hosting company.

I've used .htaccess files in the past to block IP address ranges; IP ranges were from Wizcrafts.net for example. But that only blocks http/https access. Plesk has a decent Firewall module, but that only allows you to enter one line at a time.

I've heard of APF, but I'm afraid of trying to install it with Plesk, as there are many ports that should remain open for upgrading/managing the Plesk server. The APF route will probably get me into a mess of problems.

So, I assume that iptables are a possibility. Is there a way I can shell in and add the blocklists as iptables? Does anyone have any experience or advice? I'd like to block these Nigerian hackers and other country hackers from everything I do.

Best Answer

Have you looked at fail2ban? fail2ban

It seems there has been work to use it with plesk. fail2ban with plesk

Hope this helps.

Related Solutions

Ssh – iptables rules to block ssh remote forwarded ports

Would it not be easier to switch off ssh forwarding on the ssh server? Just change AllowTcpForwarding from yes to no in your /etc/ssh/sshd_config. If this doesn't suit, you could try something along the lines of

iptables -A OUTPUT -o eth1 -p tcp --cmd-owner "sshd" -j DROP

Linux – How to Port Forward with Iptables

First of all - you should check if forwarding is allowed at all:

cat /proc/sys/net/ipv4/conf/ppp0/forwarding 
cat /proc/sys/net/ipv4/conf/eth0/forwarding

If both returns 1 it's ok. If not do the following:

echo '1' | sudo tee /proc/sys/net/ipv4/conf/ppp0/forwarding
echo '1' | sudo tee /proc/sys/net/ipv4/conf/eth0/forwarding

Second thing - DNAT could be applied on nat table only. So, your rule should be extended by adding table specification as well (-t nat):

iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 8001 -j DNAT --to-destination 192.168.1.200:8080
iptables -A FORWARD -p tcp -d 192.168.1.200 --dport 8080 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Both rules are applied only to TCP traffic (if you want to alter UDP as well, you need to provide similar rules but with -p udp option set).

Last, but not least is routing configuration. Type:

ip route

and check if 192.168.1.0/24 is among returned routing entries.

Best Answer

Related Solutions

Ssh – iptables rules to block ssh remote forwarded ports

Linux – How to Port Forward with Iptables

Related Topic