Re: iptables leaking blocked ip addresses.

["terry l. ridder" <artisticforge@gmail.com>]

hello;

reply below.

On 6/20/05, /dev/rob0 <rob0@gmx.co.uk> wrote:
> On Monday 20 June 2005 11:17, terry l. ridder wrote:
> > while i have reservations concerning posting the output of
> > iptables-save i have placed it on my web server:
> >
> > http://204.238.34.206/iptables-save-20jun2005.txt
> 
> Yikes, this is very long. First, I see that you're doing all your
> filtering in nat, PREROUTING and POSTROUTING. Why?
>

because that is the way i know that works.
it has worked fine for many years. it was not until i upgraded the
firewall machine (new computer with debian sarge) that iptables
began to leak.

>
> I prefer to do filtering in the filter table as $DEITY intended. :)
> 

<major sniip>

one of the reasons for using table nat is to dnat all ip addresses with
destination port 25 (smtp) to the mail server, 204.238.34.206.

connection tracking is turned off since at one time i was
using tarpit instead of just dropping the connections.
tarpitting all of lacnic, apnic, a large portion of ripencc, and a large portion
of arin became boring. now i just drop the connections.

i have added logging on both the firewall box, 204.238.34.232, and the mail
server, 204.238.34.206. both boxes will be logging the leaks.

-- 
terry l. ridder ><>