I'm trying to get mod\_evasive to fire off a script to add an iptables rule to deny the offending host. I've tried the suggestions from both answers [here](https://serverfault.com/questions/250258/allowing-apache-to-write-with-iptables) but I still can't get it working. Apart from the post that's linked, I'm trying to run a script as outlined [in this article](http://tellini.info/2011/11/keeping-script-kiddies-at-bay-with-mod_evasive-and-iptables/).

My Apache config has this

`DOSSystemCommand "sudo -u root /root/scripts/ban_ip.sh %s"`

The script has this

```
#!/bin/sh

IP=$1
IPTABLES=/sbin/iptables

$IPTABLES -A banned -s $IP -p TCP -j DROP

echo "$IPTABLES -D banned -s $IP -p TCP -j DROP" | at now + 5 minutes

```

I've created a 'banned' chain (I've also just tried to add it to the INPUT chain to no avail)

My /etc/sudoers looks like this:

`apache ALL=(root) NOPASSWD: /root/scripts/ban_ip.sh *`

I've disabled SELinux to make sure it's not getting in the way. I can `su apache --shell=/bin/bash` and run `sudo /root/scripts/ban_ip.sh 10.10.10.10` and it works just fine.

But when a source gets flagged as malicious in mod\_evasion, it denies the host with 403s but it never runs the script, so I'm not really gaining any advantage here.

What else can I try to get this working?