[CentOS] iptables - how to block established connections with fail2ban?

[Roberto Ragusa]

On 6/26/19 8:41 AM, MRob wrote:
> I am working to a CentOS 6 server with nonstandard iptables system without rule for ACCEPT ESTABLISHED connections. All tables and chains empty (flush by legacy custom script) so only filter/INPUT chain has rules (also fail2ban chain):
> 
> Chain INPUT (policy ACCEPT)
> target     prot opt source               destination
> f2b-postfix   tcp  --  0.0.0.0/0            0.0.0.0/0
[...]
> Chain f2b-postfix (1 references)
> target     prot opt source               destination
> REJECT     all  --  200.23.235.30        0.0.0.0/0           reject-with icmp-port-unreachable
> REJECT     all  --  177.11.167.57        0.0.0.0/0           reject-with icmp-port-unreachable
> RETURN     all  --  0.0.0.0/0            0.0.0.0/0
[...]
> When fail2ban block a IP address, established connections are allowed to continue, but with no rule to accept established connections how is that possible? Why doesn't f2b first rule block established connections?

The first rule should indeed block traffic for the established connections too.
It matches tcp only, are your connections really on tcp (and ipv4)?

Try adding the "-v" option to iptables so you can see the packet counters.
Do some experiments and check if the counters grow or not
when you expect packets to be dropped.

Regards.

-- 
    Roberto Ragusa    mail at robertoragusa.it