netfilter-owner@xxxxxxxxxxxxxxx wrote:
That was it - works perfectly. Now I have a base-line and can start
tweeking and logging from there. I will do as others have suggested, and
either only allow SSH from one IP address or range, OR use the pubkey
suggestion.
> -A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
Also think of maybe not allowing all icmp types. Some you might not
want, as redirects for example.
suggestion:
iptables -N icmp_input
-A icmp_input -p icmp --icmp-type pong -m state --state ESTABLISHED -j
ACCEPT
-A icmp_input -p icmp --icmp-type destination-unreachable -m state
--state RELATED -j ACCEPT
... also problem describing, but should not break anything if not
allowed (AFAIK...): source-quench, time-exceeded, parameter-problem -
accept in related state also...
-A icmp_input -p icmp -j DROP
-A INPUT -p icmp -j icmp_input
greets
Mart
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
