Compare commits

...

1 Commits

Author SHA1 Message Date
Adrian 1de855304e Update Firewall rules 2021-04-09 01:29:31 +02:00
4 changed files with 12 additions and 16 deletions

View File

@ -6,8 +6,6 @@
-A PREROUTING -j BLACKLIST -A PREROUTING -j BLACKLIST
-A BLACKLIST -m set --match-set blacklist src -j DROP -A BLACKLIST -m set --match-set blacklist src -j DROP
-A WHITELIST -m set --match-set local src -j ACCEPT
-A WHITELIST -m set --match-set whitelist src -j ACCEPT -A WHITELIST -m set --match-set whitelist src -j ACCEPT
COMMIT COMMIT

View File

@ -1,8 +1,7 @@
create local hash:net create whitelist hash:net comment
create whitelist hash:net create blacklist hash:net comment
create blacklist hash:net
add local 127.0.0.0/8 add whitelist 127.0.0.0/8 comment local
add local 10.0.0.0/8 add whitelist 10.0.0.0/8 comment local
add local 172.16.0.0/12 add whitelist 172.16.0.0/12 comment local
add local 192.168.0.0/16 add whitelist 192.168.0.0/16 comment local

View File

@ -1,10 +1,10 @@
*raw *raw
:KNOCK - :PORTKNOCK -
-A PREROUTING -p tcp -m tcp --tcp-flags SYN,ACK SYN -j KNOCK -A PREROUTING -p tcp -m tcp --tcp-flags SYN,ACK SYN -j PORTKNOCK
-A KNOCK -p tcp -m tcp --dport 22 -m recent --rcheck --seconds 30 --reap --name SSHOK -j RETURN -A PORTKNOCK -p tcp -m tcp --dport 22 -m recent --rcheck --seconds 300 --reap --name SSHOK -j RETURN
-A KNOCK -p tcp -m tcp --dport 22222 -m recent --set --name SSHOK -j DROP -A PORTKNOCK -p tcp -m tcp --dport 22222 -m recent --set --name SSHOK -j DROP
-A KNOCK -p tcp -m tcp --dport 22 -j DROP -A PORTKNOCK -p tcp -m tcp --dport 22 -j DROP
COMMIT COMMIT

View File

@ -3,8 +3,7 @@
-A PREROUTING -p tcp -m tcp --tcp-flags SYN,ACK SYN -j RATELIMIT -A PREROUTING -p tcp -m tcp --tcp-flags SYN,ACK SYN -j RATELIMIT
-A RATELIMIT -p tcp -m tcp --dport 25 -m hashlimit --hashlimit-above 4/hour --hashlimit-burst 4 --hashlimit-mode srcip --hashlimit-name ratelimit-smtp --hashlimit-srcmask 16 -j DROP -A RATELIMIT -p tcp -m multiport --dports 25,143 -m hashlimit --hashlimit-above 4/hour --hashlimit-burst 4 --hashlimit-mode srcip --hashlimit-name ratelimit-mail --hashlimit-srcmask 16 -j DROP
-A RATELIMIT -p tcp -m tcp --dport 143 -m hashlimit --hashlimit-above 4/hour --hashlimit-burst 4 --hashlimit-mode srcip --hashlimit-name ratelimit-imap --hashlimit-srcmask 16 -j DROP
-A RATELIMIT -m hashlimit --hashlimit-above 4/hour --hashlimit-burst 16 --hashlimit-mode srcip,dstport --hashlimit-name ratelimit-other --hashlimit-srcmask 16 -j DROP -A RATELIMIT -m hashlimit --hashlimit-above 4/hour --hashlimit-burst 16 --hashlimit-mode srcip,dstport --hashlimit-name ratelimit-other --hashlimit-srcmask 16 -j DROP
COMMIT COMMIT