Do I need raspberry-pi?

I do run IPtables on my million hit a day apache server, but frankly its only use is to allow my (fixed) IP address unrestricted accaess.

Apache itself if configured correctly will take any amount of abuse.

I just let it happen.

Only if DOS attacks slow the server unacceptably do I take any action.

Malware and ratware is a fact of life. Its only an issue if its an issue, so to speak!

This is what fail2ban was made for.

No need to fiddle with iptables.

Agreed. If you want a quiet life and your ADSL router is any good, you can not only set it to refuse all inbound connections but also make it invisible from the outside. This doesn't restrict you at all because all usual activities (getting mail, reading newsgroups, web surfing, git, ftp and sftp transfers, software updates, ..,) are handled by your programs on your computers establishing connections to external servers.

I work this way all the time. My websites are externally hosted and updated by using ftp to copy pages to the webhost from the internal copy I use to add and edit pages and I use getmail to fetch mail from my ISP's smarthost. I periodically use Gibson Research Labs' ShieldsUp tool to check that my router is still locked up tight.

On a sunny day (Thu, 21 Jun 2018 12:40:57 +0200) it happened Andreas Neumann wrote in :

Interesting, I see:

about the same idea as my scripts do, iptabes is not that hard, in fact I find it easy to use in scripting:

/usr/local/sbin/ireject # this is called to add a input deny for an IP addres to iptables, # and save the configuration. if [ "$1" = "" ] then echo "Usage: ireject IP_address" exit 1 fi iptables -A INPUT -s $1 -p all -j DROP iptables -A OUTPUT -s $1 -p all -j REJECT /usr/sbin/iptables-save > /root/firewall exit 0

then you can do something like: tail -n 100 -f /var/log/apache2/access.log | awk '/cgi/{print $1}' root@raspberrypi:~# tail -n 100 -f /var/log/apache2/access.log | awk '/cgi/{print $1}'

shows you everybody who tried the cgi thing, then pipe it through sort 'unique', then ireject..... to add it to iptables permanently

there are so many ways... Its fun to write those scripts.

At startup do (automatically) iptables-restore < /root/firewall

etc etc These are just examples OK?

fail2ban for the win!

Not sure if RPi can handle two or three streams of HD video. Are those HD?

You best choice would be familiar and available system. If you can find older PC laying around that you can use for free, I'd go with it. Why exactly do you want to use RPi?

Haven't you heard? It's the cool thing to have, daddy-o. Get hip with the tiny chip.