From mboxrd@z Thu Jan  1 00:00:00 1970
From: Ruprecht Helms <rhelms@mayn.de>
Subject: [Fwd: [suse-security] iptables rules for HTML Form Protocol Attack]
Date: 10 Jul 2003 10:33:56 +0200
Sender: netfilter-admin@lists.netfilter.org
Message-ID: <1057826036.4367.1.camel@linux.local>
Reply-To: rhelms@mayn.de
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Return-path: <netfilter-admin@lists.netfilter.org>
Errors-To: netfilter-admin@lists.netfilter.org
List-Help: <mailto:netfilter-request@lists.netfilter.org?subject=help>
List-Post: <mailto:netfilter@lists.netfilter.org>
List-Subscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>,
	<mailto:netfilter-request@lists.netfilter.org?subject=subscribe>
List-Id: <netfilter.vger.kernel.org>
List-Unsubscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>,
	<mailto:netfilter-request@lists.netfilter.org?subject=unsubscribe>
List-Archive: <https://lists.netfilter.org/pipermail/netfilter/>
Content-Type: text/plain; charset="us-ascii"
To: netfilter@lists.netfilter.org

Possible here a better list for responses.
How is to write a rule for that problem by hand.

Regards,
Ruprecht

-----Forwarded Message-----

> From: Muammer Arslan <Muammer.Arslan@experteach.de>
> To: suse-security@suse.com
> Subject: [suse-security] iptables rules for HTML Form Protocol Attack
> Date: 10 Jul 2003 10:14:34 +0200
> 
> Hi All,
> 
> Last days I often see below messages in Apache log files:
> 1.1.1.1         - - [09/Jul/2003:17:32:00+0200] "POST http://11.1.106.18:25/ HTTP/1.1" 200 475 "-" "-"
>  
> I suspect some kind of HTML protocol attack and want to stop this. Can I 
> do it somehow with IP-Tables as it is already installed on the server or 
> do you have any other ideas? I use SuSE 8.1 and SuSEfirewall2 with SuSEfirewall2-custom rules.
>  
> Thanks for your replies.
>  
> 
> Muammer