Walka z wirusami.
\nIptables mo\u017cna zaprz\u0105c do pomocy w walce z wirusami typu saser\/blaster oraz wirusami spamuj\u0105cymi.
\nOto rozwi\u0105zanie jakie mam uruchomione w swoich sieciach, jak na razie sprawdza si\u0119 ca\u0142kiem przyzwoicie.
\n$fw -N worms
\n$fw -A FORWARD -j worms
\n$fw -A worms -i \\! eth0 -p tcp -m tcp –dport 445 -m recent –set –name saser –rsource
\n$fw -A worms -i \\! eth0 -m recent –rcheck –seconds 10 –hitcount 20 –name saser –rsource -j LOG
\n$fw -t nat -A PREROUTING -p tcp -m recent –rcheck –seconds 10 –name saser –rsource -j DROP
\n$fw -A worms -i \\! eth0 -p tcp -m tcp –dport 135 -m recent –set –name blaster –rsource
\n$fw -A worms -i \\! eth0 -m recent –rcheck –seconds 10 –hitcount 20 –name blaster –rsource -j LOG
\n$fw -t nat -A PREROUTING -p tcp -m recent –rcheck –seconds 10 –name blaster –rsource -j DROP
\n$fw -A worms -i \\! eth0 -p tcp -m tcp –dport 139 -m recent –set –name blaster_2 –rsource
\n$fw -A worms -i \\! eth0 -m recent –rcheck –seconds 10 –hitcount 20 –name blaster_2 –rsource -j LOG
\n$fw -t nat -A PREROUTING -p tcp -m recent –rcheck –seconds 10 –name blaster_2 –rsource -j DROP
\n$fw -A worms -i \\! eth0 -p tcp -m tcp –dport 25 –syn -m recent –set –name spam –rsource
\n$fw -A worms -i \\! eth0 -m recent –rcheck –seconds 10 –hitcount 20 –name spam –rsource -j LOG
\n$fw -t nat -A PREROUTING -p tcp -m recent –rcheck –seconds 10 –name spam –rsource -j DROP
\nW swoich zaporach nie mam celu LOG, za wiele tego, nawet z limitem na log, taki to urok z sieciami po par\u0119 tys. u\u017cytkownik\u00f3w.
\nJednak\u017ce na pocz\u0105tek proponuje z celem LOG uruchomi\u00e6 aby sprawdzi\u0107 poprawno\u015b\u0107 dzia\u0142ania regu\u0142ek.
\nZ blokad\u0105 na spam prosz\u0119 ostro\u017cnie, jest zbyt restrykcyjna dla niekt\u00f3rych klient\u00f3w, a przy okazji wycina delikwent\u00f3w korzystaj\u0105cych z portu 25 do niecnych cel\u00f3w.
\nW ka\u017cdym razie ten zestaw ca\u0142kiem mi\u0142o sprz\u0105ta ruch w sieci.<\/p>\n","protected":false},"excerpt":{"rendered":"
Walka z wirusami. Iptables mo\u017cna zaprz\u0105c do pomocy w walce z wirusami typu saser\/blaster oraz wirusami spamuj\u0105cymi. Oto rozwi\u0105zanie jakie mam uruchomione w swoich sieciach, jak na razie sprawdza si\u0119 ca\u0142kiem przyzwoicie. $fw -N worms $fw -A FORWARD -j worms $fw -A worms -i \\! eth0 -p tcp -m tcp –dport 445 -m recent –set […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[6,4],"tags":[],"class_list":["post-9","post","type-post","status-publish","format-standard","hentry","category-iptables","category-sciaga-admina"],"_links":{"self":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts\/9","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/comments?post=9"}],"version-history":[{"count":2,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts\/9\/revisions"}],"predecessor-version":[{"id":11,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts\/9\/revisions\/11"}],"wp:attachment":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/media?parent=9"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/categories?post=9"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/tags?post=9"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}