Re: Dos attack

From: Sandro Mangovski (sandro_at_bofhlet.net)
Date: 08/26/04 

Date: Thu, 26 Aug 2004 02:53:36 +0200

On Wed, 25 Aug 2004 04:23:22 +0200, Jose Maria Lopez Hernandez wrote:

> This solution it's good if you don't have to accept incoming
> connections, but if you have to then it's a bit harder.

Why is that? You could set default policy to INPUT chain to DROP, and then
match needed ports by setting up rules in the chain. That is the usual
practice. :) Except dport matching you need to let ESTABLISHED and RELATED
connections in and that is it. Regards, 

-- 
Sandro Mangovski
ICQ: 92602206 | IRC: <Fish/#linux>@irc.idolnet.org

Relevant Pages

  • Re: blocking ports 1:1024
    ... >]I tried that, but for some reason, it blocked out my FTP transfers doing ... I would assume that once a connections is established, ... if I DROP all packets in the INPUT chain, ...
    (comp.os.linux.networking)
  • Re: ftp problem through firewall
    ... to port 20 on your INPUT chain, but not new connections. ... allowing ESTABLISHED connections from port 20 in the OUTPUT chain. ...
    (comp.os.linux.security)
  • Re: Slow printer "reconnection?"
    ... I might have found something is Group Policy that relates to my issue. ... "Allow Print Spooler to accept client connections" ...
    (microsoft.public.windows.server.sbs)
  • Re: cant send or recive any emails
    ... this should be ok if you'd have DROP policy on the INPUT chain but as you have ACCEPT policy it doesn't make any sense. ... Then you should experience problems on port 25 and as a response you'd "pierce" your firewall with a ACCEPT --dport 25 rule. ... From here I can draw only two conclusions either you sent another iptables config or you should be wide open to incoming traffic. ...
    (RedHat)
  • Re: Account lockouts
    ... you can not set per user policy or exclude some users from ... Couple of things to look for stale net use connections. ... > Note that Win9x machines do have bugs that cause them to cause multiple ... >> accounts that are continously being locked out even ...
    (microsoft.public.win2000.security)