From mboxrd@z Thu Jan 1 00:00:00 1970 From: Arnt Karlsen Subject: Re: deny cgi scanner Date: Wed, 2 Apr 2003 21:32:23 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20030402213223.22195ff5.arnt@c2i.net> References: <3E89CD8A.5020007@gmx.ch> <1049219263.4784.14.camel@elendil.intranet.cartel-securite.net> <3E89EBE5.5090804@gmx.ch> <20030401200652.GY18434@ns.snowman.net> <20030402012310.180c7aac.arnt@c2i.net> <20030402125401.GC18434@ns.snowman.net> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20030402125401.GC18434@ns.snowman.net> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Stephen Frost Cc: netfilter@lists.netfilter.org On Wed, 2 Apr 2003 07:54:01 -0500, Stephen Frost wrote in message <20030402125401.GC18434@ns.snowman.net>: > * Arnt Karlsen (arnt@c2i.net) wrote: > > On Tue, 1 Apr 2003 15:06:52 -0500, > > Stephen Frost wrote in message > > <20030401200652.GY18434@ns.snowman.net>: > > > # Bad guy detected! Add his IP to the badguy list! > > > iptables -A BADCHAIN -m recent --set --name badguy -j DROP # Add > > > IP to list > > > > ..this also shoots down the good guys with servers on dynamic dns, > > using an old recycled-by-the-isp bad guy's ip. > > That's why there's a time limit to it. ..ah, "-m recent", missed that one. ;-) -- ..med vennlig hilsen = with Kind Regards from Arnt... ;-) ...with a number of polar bear hunters in his ancestry... Scenarios always come in sets of three: best case, worst case, and just in case.