Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #3046

Re: Blocking IP addresses from specific countries

Show all headers | View raw

Hi all!

I just waltzed in to say...

On Mon, 28 Jul 2014 17:51:35 +0000, Moe Trin wrote:

> I prefer to set the firewall to ACCEPT connections from specific network
> ranges for specific ports, and REJECT all other connection attempts with
> the default rules.    If you really need to allow SSH access from "the
> world", you can look at a log-reader tool such as "BlockHosts",
> "Fail2Ban", "blocksshd" or "BruteForceBlocker", to TEMPORARILY block (10
> minutes is a good number) specific hosts that tried and failed to
> connect.  These toy "tools" work by putting in a host specific "block"
> rule in your firewall and/or hosts_access files.
> I call them "self-denial-of-service" tools, because if you fail to
> remove old host rules, you're going to be blowing a lot of CPU cycles.
> Ten minutes is enough to dissuade a bot or common Skript Kiddie, but
> shouldn't cost too many CPU cycles.   I think I've also mentioned using
> a "port-knocking" technique to temporarily allow access if you're out in
> the unknown world - sending a packet to a unrelated and closed port on
> the firewall, and having a log-reader the allow access from that IP for
> a short time (a minute) which would be long enough for you to "log in". 
> The log reader then removes the temporary access, but the ESTABLISHED
> rule in the firewall allows the connection to remain.

...that I like these hacks.

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Blocking IP addresses from specific countries Clark Smith <noaddress@nowhere.net> - 2014-07-27 20:14 +0000
  Re: Blocking IP addresses from specific countries Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2014-07-28 02:32 +0000
  Re: Blocking IP addresses from specific countries Jorgen Grahn <grahn+nntp@snipabacken.se> - 2014-07-28 07:13 +0000
  Re: Blocking IP addresses from specific countries Andrzej Adam Filip <anfi@onet.eu> - 2014-07-28 09:17 +0200
  Re: Blocking IP addresses from specific countries Joe Beanfish <joebeanfish@nospam.duh> - 2014-07-28 13:17 +0000
    Re: Blocking IP addresses from specific countries Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2014-07-28 17:51 +0000
      Re: Blocking IP addresses from specific countries Aleksandar Kuktin <akuktin@gmail.com> - 2014-07-28 19:36 +0000
        Re: Blocking IP addresses from specific countries Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2014-07-29 01:59 +0000
      Re: Blocking IP addresses from specific countries Keith Keller <kkeller-usenet@wombat.san-francisco.ca.us> - 2014-07-28 14:23 -0700
        Re: Blocking IP addresses from specific countries Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2014-07-29 01:57 +0000
      Re: Blocking IP addresses from specific countries Joe Beanfish <joebeanfish@nospam.duh> - 2014-07-29 13:16 +0000
  Re: Blocking IP addresses from specific countries Roger Blake <rogblake@iname.invalid> - 2014-07-28 20:55 +0000
    Re: Blocking IP addresses from specific countries Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2014-07-29 02:00 +0000

csiph-web