Differences

This shows you the differences between two versions of the page.

--- linux:firewall [2011/01/10 12:13]
greebo
+++ linux:firewall [2012/02/21 13:28]
greebo
@@ Line 163: / Line 163: @@
 $IPTB -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
-$IPTB -A INPUT -f -j LOG --log-prefix "FRAGMENT> "
+$IPTB -A INPUT -f -j LOG --log-prefix "Lost FRAGMENT> "
 $IPTB -A INPUT -f -j DROP
@@ Line 199: / Line 199: @@
 # Log and drop ICMP fragments (shouldn not happen at all, but often used for DoS)
 $IPTB -A INPUT -i $INTERNET --fragment -p icmp -j LOG --log-prefix "Fragmented incoming ICMP> "
-$IPTB -A INPUT -i $INTERNET --fragment -p icmp -j DROP
+$IPTB -A INPUT -i $INTERNET --fragment -p icmp -m hashlimit --hashlimit 10/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name icmp-frag -j ACCEPT
 # thou shall NOT block ALL ICMP, but only allow usefull ICMP types to pass trough
-$IPTB -A INPUT -p icmp --icmp-type 0 -m hashlimit --hashlimit 10/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name icmp0 -j ACCEPT
+# echo-reply
+#$IPTB -A INPUT -p icmp --icmp-type 0 -m hashlimit --hashlimit 10/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name icmp0 -j ACCEPT
 $IPTB -A INPUT -p icmp --icmp-type 3 -m hashlimit --hashlimit 10/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name icmp3 -j ACCEPT
 $IPTB -A INPUT -p icmp --icmp-type 4 -m hashlimit --hashlimit 10/second --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name icmp4 -j ACCEPT