Re: how to drop an IP address

Hi John,



--------------------------------------------
> On Mon, 2/5/16, John Kenyon <[email protected]> wrote:
> 
>  Subject: Re: [IPCop-user] how to drop an IP address
>  To: "IpCop List" <[email protected]>
>  Date: Monday, 2 May, 2016, 12:33
>  
>  On 02/05/2016 09:48,
>  Spyros Tsiolis wrote:
>  > Hello all,
>  >
>  > Ipcop v1.4.21.
>  > I was wondering how I could
>  "drop" an IP on the red interface before it tries
>  to connect
>  > inside.
>  >
>  > I have trouble with
>  an ip address accessing a mailserver on ORANGE and trying to
>  
>  > bring it to its knees (probably DOS
>  attack).
>  >
>  > Would you
>  chaps know what is the best way to "ground" this
>  address ?
>  >
>  > I
>  thought that putting a rule on RED and dropping it would be
>  the best.
>  > Any suggestions welcome.
>  >
>  > TIA,
>  >
>  >
>  Have
>  you considered a simple firewall on the mailserver?:
>  iptables -F
>  iptables -P INPUT
>  ACCEPT # Default rule - accept all traffic, (this is
>  the normal rule, but we make it explicit
>  here)
>  #  a chain to drop packets
>  iptables -N LOG_REJECT
>  iptables
>  -A LOG_REJECT --protocol tcp -j REJECT --reject-with
>  tcp-reset
>  iptables -A LOG_REJECT --protocol
>  udp -j DROP
>  # Direct naughty boys to the
>  reject chain
>  iptables -A INPUT -s <ip
>  address or subnet to block> -j LOG_REJECT

Yes, I have considered invoking iptables on the mailserver.
No, I wouldn't like to do it because it makes things more complicated
for me.
I am at a dangerous age and I don't want to make things more
complicated, so I thought I should keep the rules where they belong
namely the firewall itself.

I vaguely remember an /etc/iptables.local file or something like that ?
I would like to put it there.


>  That way you have IPCop doing
>  the normal firewall stuff ("allow only
>  what is allowed"), and the firewall on
>  mail server then weeds out
>  unwanted stuff
>  that IPCop allows through.


As I said above. I want to keep things relatively simple.
any ideas on putting this rule under /etc/iptables.local 
or relevant ?
 
> Another alternative is fail2ban, but you need
>  to ensure that fail2ban
>  has rules which can
>  detect the DOS attack.

Nop. Not an option for me.

Thank  you kindly,

s.t.

------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
_______________________________________________
IPCop-user mailing list
[email protected]
Manage your subscription or unsubscribe
https://lists.sourceforge.net/lists/listinfo/ipcop-user