Tags: , , ,


Forum Replies

  1. Nice work!
    One thing though, I have a feeling some ACCEPT rules should probably be before DROP.
    For example:
    -A INPUT -i lo -j ACCEPT should sit before filtering Spoofed Packets… I think.
    Maybe I’m just messing with my own head right now :wink:

  2. I agree with Pavel, you need to have the lo interface accept before blocking packets that have localhost addresses!
    Also this doesn’t seem right:
    -A INPUT -p tcp -m state --state NEW -m limit --limit 50/second --limit-burst 50 -j ACCEPT
    This will immediately accept all SYN packets as long as they don’t breach the rate limit, therefore all of the later checks will be bypassed by such packets.

  3. Hi Pavel,

    That does make sense, just changed it…thanks!

    Rene

  4. Hi Ben,

    Thanks for sharing this, I just changed it. If you have other ideas feel free to share :slight_smile:

    Rene

Ask a question or join the discussion by visiting our Community Forum