0

I'm hoping someone can enlighten me on what might be going on with firewalld.

I block possible attacks from the server. I use rich rules to do so and I've even tested blocking a specific IP but not the whole CIDR. However, when I know I do not care for that network to reach me I usually block by CIDR. The example of rich rule 

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="120.52.0.0/16" drop'

then

firewall-cmd --reload

I did this by looking up ip 120.52.96.164 with https://www.countryipblocks.net/ that can provide me the CIDR.

With the example above, I had already blocked this CIDR, but there was an FTPD attempt with an IP in this network. 

Jul 29 01:20:26 domain.ca proftpd[2250]: 0.0.0.0 (120.52.96.164[120.52.96.164]) - SSH2 session opened.
Jul 29 01:20:29 virtual.smbservices.ca proftpd[2250]: 0.0.0.0 (120.52.96.164[120.52.96.164]) - USER root (Login failed): Incorrect password
Jul 29 01:20:29 domain.ca proftpd[2250]: 0.0.0.0 (120.52.96.164[120.52.96.164]) - SSH2 session closed.

So I went to the site and looked up the IP and got the CIDR that was already in the firewalld rich rules with error

Warning: ALREADY_ENABLED: rule family="ipv4" source address="120.52.0.0/16" drop

How could it be they were able to attempt a connect to ftpd instead of being dropped as my rich rule was already there for that network?

Thomas
  • 4,225
  • 5
  • 23
  • 28
gstlouis
  • 119
  • 3
  • 12
  • 4
    [CIDR (Classless Inter-Domain Routing)](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) is a concept and that term can't be used to describe an entity defined by that concept. "net block" would be a much better term. – Sven Jul 30 '18 at 12:03
  • 2
    Why you aren't using fail2ban? – Michael Hampton Jul 30 '18 at 12:58
  • My hosting provider are on a OpenVZ with an old Kernel. I am on a updated centos7 and when using ipset I get error ipset v6.29: Kernel error received: Operation not permitted. They need to update the parent kernel as openVZ cannot share kernels like KVM. fail2ban fails trying to add bad attempts to firewalld. until I can get on newer kernel I'm stuck manually blocking bad ips by "net block" as @sven explained. But I'm curious as to why I would get a hit from that IP in the net block range... nothing else fails besides fail2ban in journalctl – gstlouis Aug 02 '18 at 01:36

0 Answers0