propper logging and dropping
Good evening,
I currently have the following macro.
/sbin/iptables -N LOGDROP/sbin/iptables -A LOGDROP -i wlan0 ! -s 10.0.0.2 -j LOG --log-level info/sbin/iptables -A LOGDROP -j DROP/sbin/iptables -A INPUT -i wlan0 -s 58.102.198.29/255.255.255.0 -j LOGDROP
What I really wan to do is log address and excluding certain subnets, and address, but drop others on offending networks. So I want to log addresses to wlan0 whose source address is not 10.0.0.2, but drop subnets which I exclude.
What is the best way to do this
Thanks
Chip
Quoted 9 lines · [email protected] wrote:
Good evening,
I currently have the following macro.
/sbin/iptables-N LOGDROP/sbin/iptables-A LOGDROP -i wlan0 ! -s 10.0.0.2 -j LOG --log-level info/sbin/iptables-A LOGDROP -j DROP/sbin/iptables-A INPUT -i wlan0 -s 58.102.198.29/255.255.255.0 -j LOGDROP
Quoted 9 lines
What I really wan to do is log address and excluding certain subnets, and address, but drop others on offending networks. So I want to log addresses to wlan0 whose source address is not 10.0.0.2, but drop subnets which I exclude.
What is the best way to do this
Thanks
Chip
If I get your question right:
$IPT -N LOGDROP
$IPT -A LOGDROP -s 10.0.0.2 -j RETURN
$IPT -A LOGDROP -j LOG --log-level INFO
$IPT -A LOGDROP -j DROP
$IPT -A INPUT -i wlan0 -s 10.0.0.0/24 -j LOGDROP $IPT -A INPUT -i wlan0 -s 58.102.198.29/24 -j LOGDROP
...
Regards
Mart
Mart,
Not Quite,
10.0.0.1 10.0.0.2 ---rest of home
network 10.0.0.x ----internet----| firewal | -------Linux server
What I want to do is allow the 10.0.0.x network.
Log packets that are not whose source address are not the 10.0.0.x network, with certain exceptions, like the time server and dns server, Drop and log specifially designated subnets that seem to pound probe port 22.
Chip
What I want to do is allow all 10.
Quoted 36 lines · Mart Frauenlob
Quoted 10 lines · [email protected] wrote:
Good evening,
I currently have the following macro.
/sbin/iptables-N LOGDROP/sbin/iptables-A LOGDROP -i wlan0 ! -s 10.0.0.2 -j LOG
--log-level info/sbin/iptables-A LOGDROP -j DROP/sbin/iptables-A INPUT -i wlan0 -s 58.102.198.29/255.255.255.0 -j LOGDROPQuoted 9 lines
What I really wan to do is log address and excluding certain subnets, and address, but drop others on offending networks. So I want to log addresses to wlan0 whose source address is not 10.0.0.2, but drop subnets which I exclude.
What is the best way to do this
Thanks
Chip
If I get your question right:
$IPT -N LOGDROP
$IPT -A LOGDROP -s 10.0.0.2 -j RETURN
$IPT -A LOGDROP -j LOG --log-level INFO
$IPT -A LOGDROP -j DROP$IPT -A INPUT -i wlan0 -s 10.0.0.0/24 -j LOGDROP $IPT -A INPUT -i wlan0 -s 58.102.198.29/24 -j LOGDROP
...Regards
Mart
Mart,
Here is my network setup
my local internet address of my home natted network is 10.0.0.0/255.255.255 My linux server is 10.0.0.2
I want to leave port 22 open so I can remotely ssh into my system. As you are probably aware there are lots of port probing going on port 22.
What I want to do is this
accept all packets which are local to 10.0.0.0/255.255.255.0 network with logging or dropping
accept packets and log packets from the internet, logging them, except if they are from certain IP address, like the ntp server, or dns server, log and drop all packets from a networks which through inspection of the logs have tried to break into my server.
Thanks
PS. the reason I sent out the test packet, was because my were not getting echo'ed back to me. The showed up on the list but I never saw them.
interernet | linsys-firewall|------------
Quoted 36 lines · Mart Frauenlob
Quoted 10 lines · [email protected] wrote:
Good evening,
I currently have the following macro.
/sbin/iptables-N LOGDROP/sbin/iptables-A LOGDROP -i wlan0 ! -s 10.0.0.2 -j LOG
--log-level info/sbin/iptables-A LOGDROP -j DROP/sbin/iptables-A INPUT -i wlan0 -s 58.102.198.29/255.255.255.0 -j LOGDROPQuoted 9 lines
What I really wan to do is log address and excluding certain subnets, and address, but drop others on offending networks. So I want to log addresses to wlan0 whose source address is not 10.0.0.2, but drop subnets which I exclude.
What is the best way to do this
Thanks
Chip
If I get your question right:
$IPT -N LOGDROP
$IPT -A LOGDROP -s 10.0.0.2 -j RETURN
$IPT -A LOGDROP -j LOG --log-level INFO
$IPT -A LOGDROP -j DROP$IPT -A INPUT -i wlan0 -s 10.0.0.0/24 -j LOGDROP $IPT -A INPUT -i wlan0 -s 58.102.198.29/24 -j LOGDROP
...Regards
Mart