Re: Prevent traceroutes

["Taylor, Grant" <gtaylor@riverviewtech.net>]

> please do this in -t mangle PREROUTING and not -t nat.  filtering in
> -t nat is poor form, and i know lots of people are probably emulating
> your scripts.

No problem.

You heard him people, the mangle table is a better place to do this, so here is an updated script:

iptables -t mangle -A PREROUTING -i $LAN -p udp -m recent --name Drop_Traceroute --update --seconds 200 --rdest -j DROP
iptables -t mangle -A PREROUTING -i $LAN -p udp -m recent --name Drop_Traceroute --set --rdest -m ttl --ttl-eq 1 -j DROP
iptables -t mangle -A PREROUTING -i $LAN -p icmp -m recent --name Drop_Traceroute --update --seconds 200 --rdest -j DROP
iptables -t mangle -A PREROUTING -i $LAN -p icmp -m recent --name Drop_Traceroute --set --rdest -m ttl --ttl-eq 1 -j DROP

I have just tested this and found it to be fully functional on my home router too.  Have fun.  :)



Grant. . . .