From: Nikolai Georgiev <voyager123bg@gmail.com>
To: Dave Handler <dhandler@nycap.rr.com>
Cc: netfilter@lists.netfilter.org
Subject: Re: How to drop an isp
Date: Sat, 05 Nov 2005 20:41:26 +0200 [thread overview]
Message-ID: <436CFCD6.7070206@gmail.com> (raw)
In-Reply-To: <436CBBFB.1070101@nycap.rr.com>
Dave Handler wrote:
> Greetings!
>
> Sorry if I worded my subject wrong, it's the best I could do!
>
> Ok, I'm on Fedora Core 3, running iptables 1.2 (which seems to be
> holding its own). Logwatch sends me my logs every morning and I see
> people trying to tap in to tcp port 25. I do lookups on the addresses
> and they all seems to be coming either from Taiwan or China. A few in
> Europe and every once in while one from the US.
>
> I've been googling around for how to block them. I'm rather green to
> iptables and some of the options confuse me. Is there a way I can
> block the whole ip from me? I'll paste in a section where there where
> accepted packets:
>
> Accepted 327 packets on interface eth0
> From 69.21.138.231 - 169 packets to tcp(22)
> From 70.86.208.18 - 6 packets to tcp(25)
> From 72.36.128.42 - 6 packets to tcp(25)
> From 202.107.195.52 - 128 packets to tcp(22)
> From 207.150.176.81 - 16 packets to tcp(25)
> From 219.133.247.226 - 1 packet to tcp(25)
> From 219.134.232.31 - 1 packet to tcp(25)
>
>
> So for instance I probably would want to block 202.107.0.0 through
> 202.107.255.255. But I'm not really sure of the syntax I should be
> using. And I don't want to screw up what I already have in place.
>
iptables -I INPUT --src 202.107/16 --p tcp --dport 25 -j DENY
> I'm going to chalk this one up as another learning experience!
>
> Thanks in advance!
>
> Dave
>
>
next prev parent reply other threads:[~2005-11-05 18:41 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-11-05 14:04 How to drop an isp Dave Handler
2005-11-05 18:41 ` Nikolai Georgiev [this message]
2005-11-05 21:49 ` Robert Nichols
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=436CFCD6.7070206@gmail.com \
--to=voyager123bg@gmail.com \
--cc=dhandler@nycap.rr.com \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox