iptables

It looks like I'm out of luck, at least for now, in getting freebsd up and running on a pi3. Which leads to a porting question.

I think I'm right in supposing linux's iptables doesn't have tables in the same sense that *bsd's pf does - a group of addresses used as a unit in a single rule and which can be updated on the fly.

So given structures in pf.conf like

table persist file "/etc/firewall/spammers" block in log quick from to any

can anyone suggest the best (or an elegant) way of implementing this sort of functionality on linux please?

TIA.

--
Mike Scott (unet2  [deletethis] scottsonline.org.uk) 
Harlow Essex 
 Click to see the full signature
Reply to
Mike Scott
Loading thread data ...

webmin and turtle?

--
"It is an established fact to 97% confidence limits that left wing  
conspirators see right wing conspiracies everywhere"
Reply to
The Natural Philosopher

Dzieki, Mike, za post o tresci:

Looks like IPSet will be a perfect match:

formatting link

--
Tomasz Torcz                Only gods can safely risk perfection, 
xmpp: zdzichubg@chrome.pl     it's a dangerous thing for a man.  -- Alia
Reply to
Tomasz Torcz

fail2ban ?

--
Graham. 

%Profound_observation%
 Click to see the full signature
Reply to
Graham.

Bingo, Exactly the sort of thing; thank you. --match-set doesn't appear in the man page for iptables (on mint at least) - I assume installing ipset adds an appropriate extension.

Pushing my luck a bit, I don't suppose there's an equivalent of the pf rate detection stuff, like:

pass in log ...... keep state (max-src-conn-rate 20/240, overload )

But thanks, I now have the key to proceeding.

--
Mike Scott (unet2  [deletethis] scottsonline.org.uk) 
Harlow Essex 
 Click to see the full signature
Reply to
Mike Scott

"IPSet is a tool for Iptables,....."

formatting link

I use Arno's iptables firewall (AIF).

Arno provides the brainwork, I provide a platform. ;)

nb

Reply to
notbob

On Wed, 07 Sep 2016 16:55:24 +0100, Mike Scott wrote: ...

-m limit ...

man iptables-extensions

Reply to
Joe Beanfish

ElectronDepot website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.