Mart,
Here is my network setup
my local internet address of my home natted network is 10.0.0.0/255.255.255
My linux server is 10.0.0.2
I want to leave port 22 open so I can remotely ssh into my system.
As you are probably aware there are lots of port probing going on port 22.
What I want to do is this
accept all packets which are local to 10.0.0.0/255.255.255.0 network
with logging or dropping
accept packets and log packets from the internet, logging them, except
if they are from certain IP address, like the ntp server, or dns server,
log and drop all packets from a networks which through inspection of the
logs have tried to break into my server.
Thanks
PS. the reason I sent out the test packet, was because my were not
getting echo'ed back to me.
The showed up on the list but I never saw them.
interernet | linsys-firewall|------------
Mart Frauenlob wrote:
netfilter-owner@xxxxxxxxxxxxxxx wrote:
Good evening,
I currently have the following macro.
/sbin/iptables -N LOGDROP
/sbin/iptables -A LOGDROP -i wlan0 ! -s 10.0.0.2 -j LOG
--log-level info
/sbin/iptables -A LOGDROP -j DROP
/sbin/iptables -A INPUT -i wlan0 -s 58.102.198.29/255.255.255.0 -j
LOGDROP
What I really wan to do is log address and excluding certain subnets,
and address, but drop others on offending networks.
So I want to log addresses to wlan0 whose source address is not
10.0.0.2, but drop subnets which I exclude.
What is the best way to do this
Thanks
Chip
If I get your question right:
$IPT -N LOGDROP
$IPT -A LOGDROP -s 10.0.0.2 -j RETURN
$IPT -A LOGDROP -j LOG --log-level INFO
$IPT -A LOGDROP -j DROP
$IPT -A INPUT -i wlan0 -s 10.0.0.0/24 -j LOGDROP
$IPT -A INPUT -i wlan0 -s 58.102.198.29/24 -j LOGDROP
...
Regards
Mart
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
