iptables

Sep 07, 2016 6 Replies
M

It looks like I'm out of luck, at least for now, in getting freebsd up and running on a pi3. Which leads to a porting question.



I think I'm right in supposing linux's iptables doesn't have tables in the same sense that *bsd's pf does - a group of addresses used as a unit in a single rule and which can be updated on the fly.



So given structures in pf.conf like



table persist file "/etc/firewall/spammers" block in log quick from to any



can anyone suggest the best (or an elegant) way of implementing this sort of functionality on linux please?



TIA.


Mike Scott (unet2 [deletethis] scottsonline.org.uk) Harlow Essex "The only way is Brexit" -- anon.
Vote
Twitter Facebook LinkedIn
T

webmin and turtle?

"It is an established fact to 97% confidence limits that left wing conspirators see right wing conspiracies everywhere"
Vote
Twitter Facebook LinkedIn
T

Dzieki, Mike, za post o tresci:

Looks like IPSet will be a perfect match:

formatting link

Tomasz Torcz Only gods can safely risk perfection, xmpp: zdzichubg@chrome.pl it's a dangerous thing for a man. -- Alia
Vote
Twitter Facebook LinkedIn
G

fail2ban ?

Graham. %Profound_observation%
Vote
Twitter Facebook LinkedIn
M

Bingo, Exactly the sort of thing; thank you. --match-set doesn't appear in the man page for iptables (on mint at least) - I assume installing ipset adds an appropriate extension.

Pushing my luck a bit, I don't suppose there's an equivalent of the pf rate detection stuff, like:

pass in log ...... keep state (max-src-conn-rate 20/240, overload )

But thanks, I now have the key to proceeding.

Mike Scott (unet2 [deletethis] scottsonline.org.uk) Harlow Essex "The only way is Brexit" -- anon.
Vote
Twitter Facebook LinkedIn
N

"IPSet is a tool for Iptables,....."

formatting link

I use Arno's iptables firewall (AIF).

Arno provides the brainwork, I provide a platform. ;)

nb

Vote
Twitter Facebook LinkedIn
J

On Wed, 07 Sep 2016 16:55:24 +0100, Mike Scott wrote: ...

-m limit ...

man iptables-extensions

Vote
Twitter Facebook LinkedIn

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required