Re: propper logging and dropping

[Ralph Blach <rcblach@gmail.com>]

Mart,

Here is my network setup
my local internet address of my home natted network is 10.0.0.0/255.255.255
My linux server is 10.0.0.2

I want to leave port 22 open so I can remotely ssh into my system.
As you are probably aware there are lots of port probing going on port 22.

What I want to do is this
accept all packets which are local to 10.0.0.0/255.255.255.0 network 
with logging or dropping
accept packets and log packets from the internet, logging them, except 
if they are from certain IP address, like the ntp server, or dns server,
log and drop all packets from a networks which through inspection of the 
logs have tried to break into my server.

Thanks
PS. the reason I sent out the test packet, was because my were not 
getting echo'ed back to me.
The showed up on the list but I never saw them.




interernet | linsys-firewall|------------

Mart Frauenlob wrote:
> netfilter-owner@vger.kernel.org wrote:
>> Good evening,
>>
>> I currently have the following macro.
>>
>> /sbin/iptables -N LOGDROP
>> /sbin/iptables -A LOGDROP    -i wlan0 ! -s 10.0.0.2 -j LOG 
>> --log-level info
>> /sbin/iptables -A LOGDROP -j DROP
>> /sbin/iptables -A INPUT -i wlan0 -s    58.102.198.29/255.255.255.0 -j 
>> LOGDROP
>>
>> What I really wan to do is log address and excluding certain subnets, 
>> and address, but drop others on offending networks.
>> So I want to log addresses to wlan0 whose source address is not 
>> 10.0.0.2, but drop subnets which I exclude.
>>
>> What is the best way to do this
>>
>>  Thanks
>>
>> Chip
>>
>
> If I get your question right:
>
> $IPT -N LOGDROP
> $IPT -A LOGDROP -s 10.0.0.2 -j RETURN
> $IPT -A LOGDROP -j LOG --log-level INFO
> $IPT -A LOGDROP -j DROP
>
> $IPT -A INPUT -i wlan0 -s 10.0.0.0/24 -j LOGDROP
> $IPT -A INPUT -i wlan0 -s 58.102.198.29/24 -j LOGDROP
> ...
>
> Regards
>
> Mart
>