I need to set up a shell to block DDOS attacks , but in that script, it's reading some Blocked IPs from /etc/sysconfig/iptables. The problem is that I don't have this directory, So I'm wondering where should I read the blocked IPs from.I followed this script by Mr Takefuji. I'm using Debian 7 and have never set Iptables untill now.
Where does Iptables store blocked IPs
iptables
That directory is a Red Hat/Fedora/RHEL directory so I wouldn't expect it to be on any other distributions of Linux. Here's what's in that file on my Fedora 14 system:# Firewall configuration written by system-config-firewall# Manual customization of this file is not recommended.*filter:INPUT ACCEPT [0:0]:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [0:0]-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT-A INPUT -p icmp -j ACCEPT-A INPUT -i lo -j ACCEPT-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT-A INPUT -m state --state NEW -m udp -p udp --dport 631 -j ACCEPT-A INPUT -m state --state NEW -m udp -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT-A INPUT -m state --state NEW -m tcp -p tcp --dport 631 -j ACCEPT-A INPUT -m state --state NEW -m udp -p udp --dport 631 -j ACCEPT-A INPUT -j REJECT --reject-with icmp-host-prohibited-A FORWARD -j REJECT --reject-with icmp-host-prohibitedCOMMITMost distros keep this information in different locations, I would determine where Debian keeps it and put this info there. The upside to using a file like this is that it's configured to be used when the iptables service is stopped & started. Again on Fedora the service is this:$ service iptables startWhen that is invoked the file I referenced above is used to establish firewall rules as described in that file.Going it aloneIf you just want to setup your own rules you don't have to use that service, it's a convenience at the end of the day. You can run iptables rules directly. In fact if you look at the format of the file referenced above you'll notice that they are just the contents of a call to iptables:-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPTIf you're new to iptables you might find a tool such as firestarter easier to getting going with its setup.