Re: how to drop an IP address

On 02/05/2016 09:48, Spyros Tsiolis wrote:
> Hello all,
>
> Ipcop v1.4.21.
> I was wondering how I could "drop" an IP on the red interface before it tries to connect
> inside.
>
> I have trouble with an ip address accessing a mailserver on ORANGE and trying to 
> bring it to its knees (probably DOS attack).
>
> Would you chaps know what is the best way to "ground" this address ?
>
> I thought that putting a rule on RED and dropping it would be the best.
> Any suggestions welcome.
>
> TIA,
>
>
Have you considered a simple firewall on the mailserver?:
iptables -F
iptables -P INPUT ACCEPT # Default rule - accept all traffic, (this is
the normal rule, but we make it explicit here)
#  a chain to drop packets
iptables -N LOG_REJECT
iptables -A LOG_REJECT --protocol tcp -j REJECT --reject-with tcp-reset
iptables -A LOG_REJECT --protocol udp -j DROP
# Direct naughty boys to the reject chain
iptables -A INPUT -s <ip address or subnet to block> -j LOG_REJECT

That way you have IPCop doing the normal firewall stuff ("allow only
what is allowed"), and the firewall on mail server then weeds out
unwanted stuff that IPCop allows through.

Another alternative is fail2ban, but you need to ensure that fail2ban
has rules which can detect the DOS attack.

------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
_______________________________________________
IPCop-user mailing list
[email protected]
Manage your subscription or unsubscribe
https://lists.sourceforge.net/lists/listinfo/ipcop-user