Изпечатай

[globaluty]

Здравейте,

Може ли да ми кажете правило за филтриране по дължина на пакета? Искам да филтрирам всички пакети с големина 46 bytes.

Ако е възможно и команда, с която ако се получават повече от 5 пакета в секунда от IP адрес, също да ги дропва.

Благодаря предварително.

[KPETEH]

Код:

iptables -I INPUT -p udp -m length --length 46 -j REJECT --reject-with icmp-host-unreachable

Може би ще помогне

[globaluty]

Код:

iptables -I INPUT -p udp -m length --length 46 -j REJECT --reject-with icmp-host-unreachable

Може би ще помогне

Провах с това, не върши работа. 

[laskov]

Код:

iptables -I INPUT -p udp -m length --length 46 -j REJECT --reject-with icmp-host-unreachable

Може би ще помогне

Провах с това, не върши работа. 

Как разбра?

[mishomvp]

Какво си решил да филтрираш? DNS атаки?

[globaluty]

Код:

Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 105.51.27.130:41764 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 160.96.49.158:41776 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 112.186.6.198:41778 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 115.141.205.180:41790 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 67.50.126.212:41792 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 144.50.87.126:41810 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 48.11.244.234:41820 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 117.141.196.212:41834 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 220.32.49.214:41832 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 50.32.39.180:41845 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 160.67.3.77:41853 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 69.244.48.243:41862 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 252.69.163.68:41865 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 11.207.50.230:41876 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 134.220.217.231:41889 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 215.169.143.202:41894 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 106.113.83.50:41902 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 119.160.130.12:41917 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 242.28.81.25:41918 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 66.115.11.105:41929 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 198.114.51.75:41933 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 87.124.186.153:41941 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 190.243.13.29:41949 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 244.79.144.112:41963 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 70.212.153.155:41969 to 95.111.44.34:27017
Mon Feb 18 20:31:55 2013; UDP; eth0; 46 bytes; source MAC address 003048672cad; from 106.133.11.210:41975 to 95.111.44.34:27017

Това съм решил да филтрирам. Всички IP адреси уж са чуждестранни, но не са. Няма и как да са, след като нямам международен канал.

[KPETEH]

Я пробвай така :

Код:

iptables -I INPUT -m mac --mac-source 00:30:48:67:2c:ad -j REJECT --reject-with icmp-host-unreachable