[Shorewall-users] IP blocking not working

[Tom Eastep]

Sorry, I didn't answer your question.
Shorewall is letting those packets through because they are in the
"Established" or "Related" state. The rule you added is likely a rule to
match packets in the "NEW" state.
Flush your connections with the commands from my last email.
FYI, it helps to run that command a few times in a row.

Also be sure that the DROP rule is in the /etc/shorewall/blrules file or
that it is before any net->fw ACCEPT rules in /etc/shorewall/rules

-Tom

[Grant]

Post by Tom Eastep

Shorewall is letting those packets through because they are in the
"Established" or "Related" state. The rule you added is likely a rule to
match packets in the "NEW" state.
Flush your connections with the commands from my last email.
FYI, it helps to run that command a few times in a row.

OK I'll remember conntrack-tools.

Post by Tom Eastep
Also be sure that the DROP rule is in the /etc/shorewall/blrules file or
that it is before any net->fw ACCEPT rules in /etc/shorewall/rules

That could have been the problem too. I had the DROP rule at the
bottom of my rules file after various ACCEPT rules.

I've also just implemented nginx limit_req along with fail2ban to
automate this sort of thing.

- Grant

------------------------------------------------------------------------------