Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #2894

Re: Blocking entire domains

Show all headers | View raw

Hello,

James H. Markowitz a écrit :
>>> 	I keep getting breakin attempts from a variety of domains, the
>>> worst being hinet.net. I would therefore be interested in blocking all
>>> IP addresses in this domain with iptables rules. Is this possible?

Short answer : no. iptables doesn't know about domains.

> 	Thanks for your suggestion. What I had in mind was for sendmail, 
> and after some googling I came across the surprisingly simple iptables 
> incantation:
> 
> 	iptables -I INPUT -p tcp --dport 25 -m string --string "Host: 
> hinet.net" --algo bm -j DROP

Of course this has nothing to do with your original request. I am
surprised, AFAIK "Host:" string is not part of the SMTP protocol, but
rather the HTTP protocol. Do the attackers try to speak HTTP to your
SMTP server ? Also, beware of the side-effects : if this post had be
transmitted by mail, your rule may have blocked it because it contains
the string.

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Blocking entire domains "James H. Markowitz" <noone@nowhere.net> - 2014-04-06 03:12 +0000
  Re: Blocking entire domains Keith Keller <kkeller-usenet@wombat.san-francisco.ca.us> - 2014-04-05 20:38 -0700
    Re: Blocking entire domains "James H. Markowitz" <noone@nowhere.net> - 2014-04-06 14:25 +0000
      Re: Blocking entire domains Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-04-06 17:08 +0200
  Re: Blocking entire domains Joe Beanfish <joebeanfish@nospam.duh> - 2014-04-07 14:05 +0000
    Re: Blocking entire domains Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2014-04-07 19:12 +0000

csiph-web