On 9/21/23 03:12, Simon Perry wrote:
If you're actively blocking outbound to Hetzner ranges then that is a YOU problem.
No, outbound was fine, it was the INPUT chain block from the 95.216 ranges that got me. I have a top-100 script that dumps the address ranges with the top 100 blocked invalid ssh, smtp, etc.. attempts and those ranges from RIPE, APNIC, and AFRINIC are added to my INPUT chain to drop - that is what also blocked the Arch IPs.
Yes, a bit heavy-handed, but I have no overseas business and this eliminated 99% of the annoying server intrusion attempts.
-- David C. Rankin, J.D.,P.E.
