Tracking Forums, Newsgroups, Maling Lists
Home Scripts Tutorials Tracker Forums
  Advanced Search
  HOME    TRACKER    Web Hosting


Advertisements:




SuperbHosting.net & Arvixe.com have generously sponsored dedicated servers and web hosting to ensure a reliable and scalable dedicated hosting solution for BigResource.com.







Iptables - Block Inbound & Outbound


What is the command I need to issue to block an IP address from my server? I need to block both inbound and outbound access.

I need the rule to append to existing rules so if the server is rebooted the rule will still be in effect.


View Complete Thread with Replies

Sponsored Links:

Related Forum Messages:
Port Speed: Big Difference Inbound Vs Outbound
I am moving into the world of dedicated servers (from VPS). I just got a server from Serveraday.com /OLM.net.

When I was doing bandwidth tests, I found the server's inbound speed was much slower than outbound. I tried downloading a bunch of different provider's 10MB test files from the command line of my server using wget. They were all around 20-30 Kbps.

When I take those same 10MB files and serve them from my dedicated box, the results are much different. My server can push the files out at over 1Mbps.

Why would my server be set up this way, and is this normal behaviour? I sent a ticket to OLM, but their support seems to take a long time. So I figured I would bounce the question off of all you here on WHT

View Replies!   View Related
Monitor/audit Inbound/outbound Emails
any good solution for corporates out there?

View Replies!   View Related
Mailenable : Copy All Inbound / Outbound Email
I'm using the free edition of MailEnable and need to configure each post office to copy all incoming and outgoing email to one of the email accounts on the same post office.

Is there a way to configure this ?

I know I can configure mail forwarding on incoming mail per account but need to do it for all acounts (except the audit account).

e.g. anythinghere@dbnetsolutions.co.uk
incoming or outgoing would be copied to audit@dbnetsolutions.co.uk

View Replies!   View Related
How To Block Port 25 Using IPtables?
For some reason, I want to block port 25 for temporary time while editing the exim config and open it back using iptables -F command.

Anyone can let me know the command to block port 25 using IPtables command.

View Replies!   View Related
Iptables: Expiring Ip Block
I'm trying to figure out an iptables rule to block certain ips for a limited duration, after which the block rule will be removed.

hits to the iptables filter while the ip is blocked should not renew the timer.

i got as far as:

iptables -A INPUT -m recent --name blacklist --rcheck --seconds 10 -j REJECT
iptables -A INPUT -m recent --name blacklist --remove

but how do i blacklist an ip now ? (this needs to be done via external app and not via iptables matches/hitcounts)
iptables -A INPUT -s xxx.xxx.xxx.xxx -m recent --name blacklist --set
would renew the blacklist every time that ip sends a packet no matter if it is blocked or not. and also that rule would remain in iptables even when expired

View Replies!   View Related
Iptables Block An IP Not Working
I use

iptables -I INPUT -s 60.216.238.212 -j DROP

To block ip, not working

After issue

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

I can still see

87 218.86.252.158
163 219.150.191.62
301 60.216.238.212

60.216.238.212 still has 301 connection, any idea.

Basically, I use ddos-deflate to block ddos attack.
I already set the max conection to 25.
But it seems not working.
all the connections over 25 have not been blocked.
Did I miss something?
I mean after I issue

iptables -I INPUT -s 60.216.238.212 -j DROP

Do I need to do something like refresh iptables?

View Replies!   View Related
IPTables - Block Internet Access To SSH (22) Except Verified IP's
I recently looked at my secure and mesaages log and have been getting a lot of failed SSH root login attempts. So I thought I better do something about it.

Ideally I want to allow SSH login from just 3 remote public IP's, and block all others from even trying

How would you go about implementing this?

I have tried using IPTables, but I think im getting the rule wrong somewhere.

Here is what I have:

Code:
## Access to SSH from Pre-approved IP Addresses ONLY ##

iptables -I INPUT 1 -p tcp --dport 22 -s 123.123.123.123 -j ACCEPT
iptables -I INPUT 2 -p tcp --dport 22 -s 123.123.123.124 -j ACCEPT
iptables -I INPUT 3 -p tcp --dport 22 -s 123.123.123.125 -j ACCEPT
iptables -I INPUT 4 -p tcp --dport 22 -s 0.0.0.0 -j DROP

However this still lets me login from IPs not in the list above?

View Replies!   View Related
VPS With Mostly Inbound Traffic
Imagine you want a set of servers (VPSs would be a cheaper choice, that is why I am posting here) that do not have much outbound traffic but download from other servers (more or less as spiders, but I am not trying to create a web index). Disk space or memory size are not important, but port speed and monthly transfer should be as high as possible. As inbound traffic is less frequently used, I wonder if any provider offer cheaper rates if traffic is like this.

I have been searching the forums and have not found too much about this topic (a quite related post named "I want to download the Internet" or something similar did not get a conclusion).

View Replies!   View Related
Why Inbound Traffic So High
Why did my inbound traffic jump? Any ideas what could be happening here? I have this server and do not upload anything on the server?

View Replies!   View Related
Is It Possible To Specify An IP Address To Use For Inbound Traffic
I have 2 IPs bounded on a Windows 2003 server. These 2 IPs have different network routes (one uses network A, one uses network B). Obviously for outbound traffic I can freely choose which IP to use (I simply choose to use [url]or [url]), however I wonder if it's possible to tell the server which IP it should use for inbound traffic when I need to download something from the internet to the server?

View Replies!   View Related
Inbound SYN Flood Attack
my server under attack with syn flood and i attach the active connection during attack

View Replies!   View Related
Error APF :: {glob} Opening Inbound Udp Port
We have following error when try to start apf in one of our vps:

apf(3126): {glob} opening inbound tcp port 80 on 0/0
apf(3126): {glob} opening inbound tcp port 110 on 0/0
apf(3126): {glob} opening inbound tcp port 111 on 0/0
apf(3126): {glob} opening inbound tcp port 143 on 0/0
apf(3126): {glob} opening inbound tcp port 443 on 0/0
apf(3126): {glob} opening inbound tcp port 465 on 0/0
apf(3126): {glob} opening inbound tcp port 623 on 0/0
apf(3126): {glob} opening inbound tcp port 918 on 0/0
apf(3126): {glob} opening inbound tcp port 993 on 0/0
apf(3126): {glob} opening inbound tcp port 995 on 0/0
apf(3126): {glob} opening inbound tcp port 2082 on 0/0
apf(3126): {glob} opening inbound tcp port 2083 on 0/0
apf(3126): {glob} opening inbound tcp port 2086 on 0/0
apf(3126): {glob} opening inbound tcp port 2087 on 0/0
apf(3126): {glob} opening inbound tcp port 2095 on 0/0
apf(3126): {glob} opening inbound tcp port 2096 on 0/0
apf(3126): {glob} opening inbound tcp port 3306 on 0/0
apf(3126): {glob} opening inbound tcp port 3389 on 0/0
apf(3126): {glob} opening inbound tcp port 6666 on 0/0
apf(3126): {glob} opening inbound tcp port 7776 on 0/0
apf(3126): {glob} opening inbound tcp port 7777 on 0/0
apf(3126): {glob} opening inbound tcp port 7778 on 0/0
apf(3126): {glob} opening inbound tcp port 7779 on 0/0
apf(3126): {glob} opening inbound tcp port 8887 on 0/0
apf(3126): {glob} opening inbound tcp port 8888 on 0/0
apf(3126): {glob} opening inbound tcp port 8889 on 0/0
apf(3126): {glob} opening inbound udp port 21 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound udp port 53 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound udp port 161 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound udp port 465 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound udp port 623 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound udp port 873 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 21 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 22 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 25 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 26 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 27 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 37 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 43 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 53 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 80 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 110 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 113 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 443 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 465 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 623 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 873 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 2089 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound tcp port 3389 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound udp port 20 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound udp port 21 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound udp port 53 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound udp port 161 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound udp port 465 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound udp port 623 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening outbound udp port 873 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound icmp type 3 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound icmp type 5 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound icmp type 11 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound icmp type 0 on 0/0
iptables: Unknown error 4294967295
apf(3126): {glob} opening inbound icmp type 30 on 0/0

View Replies!   View Related
After Flush+zero Iptables, Will A New Iptables Ban Work
I execute the following commands, in the following order:

iptables --flush
iptables --zero
iptables -A INPUT -s 218.65.12.161 -j DROP

will that last command successfully ban that IP until reboot?

If not, what needs to be done? I can't access my site if I don't flush + zero iptables first but I need to be able to ban with iptables.

View Replies!   View Related
Exim Outbound Relay Per Domain
I have been searching for a solution to a problem that shouldn't exist but it does.

Background:

I have a customer on a UK server who sends emails to 500+ recipients on a monthly basis, and all but 3 emails are delivered....

The 3 that don't go, bounce after 3 days (as per the exim setup)

The 3 recipient domain's that reject don't seem to accept email from UK/European ip's and I have tried to send them emails from 4 different networks and still they bounce.

I have even tried to contact them via gmail, and still not heard back.

Proposed solution:

I want to be able to send email for that 1 domain to a Postfix Relay I have in the US.

Question:

How do I achieve this within Exim (a Cpanel Server).

I have found that so far its to do with the Router Configuration section within the Cpanel Exim setup, but I cannot seem to find an example of what and where i need to change the config...

Can anyone provide an example?

View Replies!   View Related
Is It Possible To Restrict Outbound Email With Smartermail
A prospect wants an email server that could allow him to restrict some accounts and make them send emails only to the companies domain.

I was thinking of setting up a VPS with smartermail, so I was wondering if this be done with smartermail?

View Replies!   View Related
HiVelocity Forcing Cogent Outbound
Could you guys look and see if what I am seeing is right? They offer Global Crossing and Cogent officially. So if I use GLBX looking glass, I get this.

Trying trace from node 'Miami, FL, US' to '96.31.73.xxx'
1 64.214.16.65 (64.214.16.65) 0.761 ms 0.608 ms
2 so0-0-0-2488M.ar2.TPA1.gblx.net (67.17.66.165) 5.690 ms 5.695 ms
3 WBS-CONNECT-LLC.ae0.409.ar2.TPA1.gblx.net (64.214.147.222) 5.731 ms 5.880 ms
4 69.46.31.106 (69.46.31.106) 7.442 ms 6.667 ms
5 node1.sarorahosting.com (96.31.73.2) 15.734 ms 15.993 ms
6 96.31.73.xxx (96.31.73.xxx) 15.861 ms 15.795 ms

Now if I tracert from the VPS to the GLBX router, I get this.

traceroute to 64.214.16.65 (64.214.16.65), 30 hops max, 40 byte packets
1 node1.sarorahosting.com (96.31.73.2) 0.072 ms 0.035 ms 0.008 ms
2 69.46.31.105 (69.46.31.105) 0.731 ms 0.863 ms 1.003 ms
3 gi0-6.na21.b001841-0.tpa01.atlas.cogentco.com (38.99.204.33) 1.147 ms 1.142 ms 1.428 ms
4 gi4-1.core01.tpa01.atlas.cogentco.com (38.20.33.89) 0.818 ms 0.814 ms 0.807 ms
5 po2-0.core01.mco01.atlas.cogentco.com (154.54.27.90) 148.004 ms * *
6 po5-0.core01.jax01.atlas.cogentco.com (66.28.4.146) 5.847 ms 5.839 ms 5.872 ms
7 po5-0.core01.atl01.atlas.cogentco.com (154.54.3.197) 11.953 ms 23.819 ms 23.870 ms
8 te3-3.ccr01.atl01.atlas.cogentco.com (154.54.5.38) 11.721 ms 11.752 ms 11.787 ms
9 te8-2.mpd01.atl04.atlas.cogentco.com (154.54.3.174) 11.962 ms 11.921 ms 11.987 ms
10 ge4-1-0-390-1000M.ar4.ATL1.gblx.net (64.208.110.97) 12.252 ms 12.359 ms 12.444 ms
11 64.214.16.65 (64.214.16.65) 16.026 ms 16.061 ms 16.594 ms

Now what would be causing this to happen?

View Replies!   View Related
Default Outbound IP Address With Virutal IPs
I have an interesting situation on my CentOS 4 server. I have a number of virtual adapters (e.g. eth0:1, eth0:2 etc), and for some reason all outbound traffic is going through one of these, not eth0. If I go to ipchicken.com, it shows the ipaddress of a virtual adapter, not the normal eth0 adapter.

I have been looking around for information on how to set the default adapter to eth0, but I can't seem to find anything. I can't reboot yet, as it's a production server, so I have to wait for 'scheduled maintenance'. If that's the solution, I can try it, but I am sure there is another underlying issue/routine here.

Is there a way, while live, to set the outbound adapter back to eth0?

Please note, that I have only just realized this has happened. In fact, it has been this way since November. I can tell because server name stamps on Email messages sent from this server indicate a virtual domain at that IP address. I recall I had done some work around that time, which had involved me ifup'ing and ifdown'ing some of these adapters (but not eth0, or the eth0:100 adapter (if I recall correctly) that is now the default).

Also note that I have groups of eth0 adapters, such like:
eth0:1
eth0:2
eth0:3
eth0:100
eth0:101
eth0:102

It's the eth0:100 adapter that is now the default.

View Replies!   View Related
How To Setup Outbound Email Forwarding In Cpanel ?
I need to setup forwarding of a copy of all outbound smtp emails from clients domain (setup on CentOS/cPanel) to their backup gmail / pop account...

View Replies!   View Related
Server Sending High Outbound Bandwidth
My datacenter has told me about my server sending high amount of outbound bandwidth from my server:

During the attack time my email logs, I found several messages:
cpdavd failed @ Thu Nov 6 12:21:18 2008. A restart was attempted
automagically.

Question #1. How can I check which user is using cpdavd (connect from their PC to the home folder)

I suspect someone is connecting their PC to my server and uses very high bandwidth!

The datacenter says the attack is still going on when they plug in the server.

Question #2. How can I check what is sending outgoing traffic on the server right now?

View Replies!   View Related
Can't Send Outbound Email From My Server With Comcast
It appears Comcast is now blocking port 25. As a result, I can't sent outbound email via my dedicated server. They had me change to port 587 for my comast email account, but that doesn't solve my not being able to send outbound from my dedicated server.

Is there anythighn I can do (like change the post my mail server uses to 587) so that I can send outbound mail from my server with outlook (over Comcast connection) or am I just stuck now with using web mail?

View Replies!   View Related
Can We Create OutBound Rules In Smarter Mail
i have installed a new mail server i.e. SmarterMail, and from past few days i have devoted much time to find "How to create Out Bound rules in Smarter Mail?" but unfortunately i ended up with no solution, hence here i am seeking help from all the member of WHT for my two questions:

1) Can we create an out bound rule in smartermail?

2)if yes, then what is the process for same?

View Replies!   View Related
Stop Outbound Spam On An Open Wireless Network
I'm not sure if this is the right place to be posting this, but at our hotel, we have wireless routers (Linksys) that any of our clients can use to connect their laptops to the internet. We have been getting reports from our ISP that spam has been coming from our external IP address, so I wanted to know what people would recommend as ways to combat either our computers or any of our clients' computers from sending out spam. The internet is connected through a firewall/server computer running linux. I thought about blocking port 25, but I'm sure we would have clients complaining about not being able to send any mail.

View Replies!   View Related
Spam Test For Outbound False Positive Mail
I tried a little searching both in Google and on here but this is probably going to be a private or member-based thing anyway.

I've gotten a couple comments that some of my outbound personal mail is ending up in spam folders. I think it's almost completely limited to having Outlook (or Express?) as a client... which I assume doesn't even do network-based lookups. Nonetheless I don't seem to be on any blacklists, and running it through my own spamassassin filter comes up basically zero score. But the fact that more than one person has had the problem concerns me greatly. Also, I haven't seen any significant reason why the content itself would trigger anything.

I realize a public spam test service would basically be a "testing ground" for spammers to evade detection, but there's obviously legitimate uses as well... is there such a tool somewhere? Thanks for any advice. Public information sharing is key to a forum, but PMs are welcome in this case.

View Replies!   View Related
Can You Limit Number Of Recepients In CPanel Outbound Email (webmail/smtp)
I want to cap users on outbound emails ....

Example: User A sends an email to 100 people (using To,cc and bcc) . However the server needs to stop sending that message and cap a limit of 5 recipients per email

View Replies!   View Related
Way To Block IP
I am curious, what is the best way to ban certain IP from accessing server? I have software firewall (APF) and there is, of course, /etc/hosts.deny.

Which is the most efficient? I've read that software firewall becomes unstable after so many entries. Does the same apply to /etc/hosts.deny file?

Or is there a better way altogether?

View Replies!   View Related
How To Block IP
some Chinese forums hotlinking images from my site and I even delete those images they keep sending me huge amount of http requests to my hosting server and eating 800mb of memory and upto 1GB cause server crash

I tried to block incoming referrer traffic from those sites using htaccess but it didn't work , I still see their http request on my server logs and memory keep goes high , am not sure my code is the right

how can I block these http request from these domains , what is the right htaccess code , I use DirectAdmin panel by the way

View Replies!   View Related
Block IP, How To
Can any one let me know how to block a range IP on SSH?

Eg: i'd like to block all IP: 67.63.123.xxx

View Replies!   View Related
How To Block A Block Of IP'S
I'm currently experiencing a lot of IP's starting with 200 and 201 (from Brazil) some IPís have over 200 connections. I have APF installed and want to know how to block a block on ip's if this is possible.
IPS:
200.11.*******
201.*******

View Replies!   View Related
How To Block All Other IP And Allow Certain IP Using APF
I have DDos Attack right now so I want to block all the IP from all over the world and just allow certain IP range.

How to do it using APF or any other way.

For example I want to block everything but Germany IP

Code:
53.0.0.0/8
62.4.64.0/19
62.8.32.0/19
62.8.128.0/17
62.24.0.0/19
62.26.0.0/15
62.40.0.0/19
62.44.32.0/19
62.48.64.0/19
62.50.32.0/19
62.50.96.0/19
62.50.192.0/18
62.52.0.0/14
62.61.32.0/19
62.68.0.0/19
62.72.0.0/18
62.72.64.0/19
62.75.128.0/17
62.78.64.0/20
62.80.0.0/18
62.80.96.0/19
62.89.160.0/19
62.91.0.0/16
62.93.192.0/18
62.95.128.0/18
62.104.0.0/16
62.109.64.0/18
62.109.128.0/19
62.111.0.0/17
62.112.32.0/19
62.112.64.0/19
62.112.128.0/19
62.116.128.0/18
62.117.0.0/19
62.128.0.0/19
62.128.160.0/19
62.133.0.0/19
62.138.0.0/16
62.141.32.0/19
62.141.160.0/19
62.145.0.0/19
62.143.0.0/16
62.144.0.0/16
62.146.0.0/16
62.152.0.0/19
62.152.160.0/19
62.153.0.0/16
62.154.0.0/15
62.156.0.0/14
62.165.0.0/19
62.168.192.0/19
62.169.0.0/19
62.176.128.0/19

View Replies!   View Related
To Block IP
how can i block to access to some IP?

for examaple scripts in my hosts can not access to some IPs i want

View Replies!   View Related
Iptables Gone
I am experiencing a strange problem with iptables: after in activate them, they are gone in a few minutes. For example, I drop traffic from an ip and after few seconds, all rules are flushed without touching anything!

View Replies!   View Related
How Many IPs Can I Add To IPtables ?
I need to block about 5000 IPs .. Is it possible to add this amount of IPs to iptables?

I mean ... Will this slow down the machine response?

View Replies!   View Related
Iptables Or Apf?
What do you prefer or what do you think is better, iptables or apf for a firewall?

View Replies!   View Related
Csf And Iptables
i install csf on centos,

my server is working but the network is unreachable,

i try to run "service iptables stop",

and the server is unreachable now,

i check from whm,it shows csf is working,

but i ssh the server and type "service iptables status",

it shows "firewall is stopped",

is it correct?

is not,how can i fix the issue?

View Replies!   View Related
IPTables
Is there a way for me to whitelist myself or something?

I get up everyday and have to call LSN because my server has blocked me for some reason...

View Replies!   View Related
Iptables
If I keep getting spam from a certain IP, can I add that IP to Iptables? Will it stop me receiving spam from that IP? I'm not quite sure how it all works.

Or what is the most effective method to stop spam?

View Replies!   View Related
IPTables
I've got two VPS's and both have the same ruleset for outbound EG_TCP

Code:
EGF="1"

EG_TCP_CPORTS="21,25,37,43,53,80,110,113,123,443,873,2089,3306"

EG_UDP_CPORTS="53,465,873,6277"
Whenever I turn EGF to 1 my VPS locks me out of everything, I need togo into hyperVM to turn it off and restart my firewall.

What would cause this?

It's Fedora Core 5 on OpenVZ i've googled and cannot seem to find a reason why it would do that. Could be something in the host node kernel that may need adjusting?

View Replies!   View Related
Iptables
I am working with iptables and am trying to figure out the best ruleset for cpanel servers.

I have a few custom ports for a few services, but other than that, does anyone have a recommended ruleset for the typical cpanel cluster?

View Replies!   View Related
Iptables
how can i clear iptables?

i enter many ip in it that most of them is worng and i must clear it

View Replies!   View Related
Iptables
Do you find iptables enough or do you use a hardware firewall for linux? I haven't used anything less than hardware firewalls for years but I gather than most simply rely on iptables. Is that a smart choice?

View Replies!   View Related
IPTables
I got blocked by my server. Hivelocity helped me to gain access by my server.

I was told that to avoid being blocked again I should type

iptables -A INPUT 202.155.151.185 -j ACCEPT

What I ended up was

iptables -A INPUT 202.155.151.185 -j ACCEPT
Bad argument `202.155.151.185'
Try `iptables -h' or 'iptables --

View Replies!   View Related
Iptables !
i have code :

1. IF=`/sbin/route | grep -i 'default' | awk '{print$8}'`
2. IP=`/sbin/ifconfig $IF | grep "inet addr" | awk -F":" '{print$2}' | awk '{print $1}'`
3. IPT="/usr/sbin/iptables"
4. NET="any/0"
5. DNS="xxx.xxx.xxx.xxx yyy.yyy.yyy.yyy"
6. SERV_TCP="22 80 443 "
7. SERV_UDP="53 123"
8. HI_PORTS="1024:65535"
........

i dont know line of 5's sense .I am must changed warrant is what?

View Replies!   View Related
Iptables
Code:

# iptables -D INPUT -s 25.55.55.55 -j DROP
iptables v1.3.8: Couldn't load target `standard':/usr/local/lib/iptables/libipt_standard.so: cannot open shared object file: No such file or directory
What is going on? The libipt_standard.so file is located in /lib/iptables, but not /usr/local/lib/iptables. I tried moving all of the libipt files into the /usr/local/lib/iptables directory, but I got segmentation errors.

View Replies!   View Related
How To Tell Fortigate Not To Block My VPS IP
Fortigate appliances blocking an IP that is not in RBLs I have a problem with the IP 66.187.108.157 of my VPS it seems to be blocked by Fortigate appliances, as you can see in this error message:

SMTP error from remote mail server after RCPT TO:[url] host mail.am.com.pe [200.62.221.107]: 554 5.7.1 This message has been

blocked because it is from a FortiGuard - AntiSpam black IP address.(connection black ip 66.187.108.157)

However I have searched in this URL [url]and it is clean.

Any ideas on how to have/force Fortigate databases to become updated.

View Replies!   View Related
Block Spam
I'm having difficulties with a whm running on centos dedicated server. The problem is that we receive too much of spam and junk emails. by too much I mean 2000 bulks per week. It's killing us.

how I can stop it.

View Replies!   View Related
How To Block The World
IM about tired of spam and hackers putting phishing items on my server.

My question is.

How can I block the whole world expect for US, CA and UK?

I've added several countrys to csf's csf.deny list but half of them keep disappearing.

View Replies!   View Related
Block A Specific ISP
Is there any way to block a particular ISP? Have a visitor that changes IP hourly, but the IP always resolves back to a hostname like dsl.yuns.sksk.uk .

I have CSF installed. Any way to block all visitors from dsl.yuns.sksk.uk?

View Replies!   View Related
Suhosin Block
in one of my servers i have this line in my ConfigServer Security & Firewall:

190.28.118.155 # lfd: 10 (suhosin) login failures from 190.28.118.155 - Mon Jun 16 23:27:50 2008

is this ok? i mean... its an attack of some sort? i know suhosin is meant to increase php security, so its blocking an attack right?

View Replies!   View Related
Apf To Block An IP Address
I have blocked this IP 125.115.144.28

/etc/apf/apf -d 125.115.144.28

But

netstat -anp|grep tcp|awk '{print $5}'| cut -d : -f1 | sort | uniq -c | sort -n

It still showing

202 125.115.144.28

Why?

Is it supposed to blocked right away, or need some time to get blocked.

When I checked /etc/apf/deny_hosts.rules

The IP is in the file.

View Replies!   View Related
Block An IP Range ...
I set up a forum for a small group of users, so I don't really wish to see spiders or bots on it, so I've put a robots.txt file there to prevent all of them from accessing the forum pages.

I know not all bots follow the robots.txt rule, and these days a really annoying bot called MUNAXNET or Munax AB with IP range 82.99.30.0 - 82.99.30.127 is causing the forum to have extra and unexpected loads.

I've tried to block this IP range with .htaccess and uploaded it to the root of the site a few days ago, here is the content:

<Limit GET HEAD POST>
order allow,deny
deny from 82.99.30.0-82.99.30.127
allow from all
</LIMIT>
However strangely it seems that all of these are not working for this bot, today I saw my forum had 80 users online and that army still keeps coming and browsing all pages of my forums...

I tested the .htaccess with blocking myself, and it actually worked for me, dunno why it's not working for that bot..

View Replies!   View Related
Should I Block Yandex
I was just researching my log analyzers to see whats happening... I noticed something new in the logs, a large number of unnamed robots or spiders... so I found the robot... it was this:

23310 7.99% 23303 9.48% 1159765 18.56% 22 0.12% 77.88.26.26

After some reading, sites say the ip belongs to spider26.yandex.ru

For simply security reasons, would it be in best interest to block the entire subnet? It seems that the same IP ending in .25 belongs to spider25.yandex.ru

View Replies!   View Related
Anyone Using Snort - Does It Really Block Anything
Is anyone using snort?

Does it really block any web based attacks?

I know I can do port scans, and it can alert you to a whole bunch of false positvies, but is it blocking/detecting any serious attacks on your web server?

If so, which rules are the one is alerting on?

View Replies!   View Related
Block A Bot By Netmask
I have a Juniper firewall. I'm seeing a ton of traffic from the Twiceler bot in the range of 100,000 hits a day. Luckily they've more recently put up a list of IP addresses their bots use at:

[url]

So, I'm blocking all of these now. However I think it's a simple Netmask issue I'm having. I'm blocking all ports from

208.36.144.0/24
38.99.13.0/24
38.99.44.0/24
64.1.215.0/24

However, I am still seeing the bot in server log files. Could it be that I should not be specifying .0 at the end, but instead .1? Like this in the policy?

64.1.215.1/24

View Replies!   View Related
Copyright © 2005-08 www.BigResource.com, All rights reserved