|
@@ -495,43 +495,32 @@ iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
|
495
|
495
|
|
496
|
496
|
# limit ssh logins to no more than 3 per min
|
497
|
497
|
iptables -A INPUT -p tcp --dport 22 -m limit --limit 3/minute --limit-burst 1 -j ACCEPT
|
498
|
|
-iptables -A INPUT -p tcp --dport 22 -m limit --limit 3/minute --limit-burst 1 -j LOG --log-prefix SSH-DROP
|
499
|
498
|
|
500
|
499
|
# Limit web connections to 20 per min
|
501
|
500
|
iptables -A INPUT -p tcp --dport 80 -m limit --limit 10/minute --limit-burst 1 -j ACCEPT
|
502
|
|
-iptables -A INPUT -p tcp --dport 80 -m limit --limit 10/minute --limit-burst 1 -j LOG --log-prefix HTTP-DROP
|
503
|
501
|
iptables -A INPUT -p tcp --dport 443 -m limit --limit 10/minute --limit-burst 1 -j ACCEPT
|
504
|
|
-iptables -A INPUT -p tcp --dport 443 -m limit --limit 10/minute --limit-burst 1 -j LOG --log-prefix HTTPS-DROP
|
505
|
502
|
|
506
|
503
|
# Limit number of XMPP connections
|
507
|
504
|
iptables -A INPUT -p tcp --match multiport --dports 5222:5223,5269,5280:5281 -m limit --limit 10/minute --limit-burst 1 -j ACCEPT
|
508
|
|
-iptables -A INPUT -p tcp --match multiport --dports 5222:5223,5269,5280:5281 -m limit --limit 10/minute --limit-burst 1 -j LOG --log-prefix XMPP-DROP
|
509
|
505
|
|
510
|
506
|
# Limit IRC connections
|
511
|
507
|
iptables -A INPUT -p tcp --dport 6666:6670 -m limit --limit 10/minute --limit-burst 1 -j ACCEPT
|
512
|
|
-iptables -A INPUT -p tcp --dport 6666:6670 -m limit --limit 10/minute --limit-burst 1 -j LOG --log-prefix IRC-DROP
|
513
|
508
|
|
514
|
509
|
# Limit gopher connections
|
515
|
510
|
iptables -A INPUT -p tcp --dport 70 -m limit --limit 10/minute --limit-burst 1 -j ACCEPT
|
516
|
|
-iptables -A INPUT -p tcp --dport 70 -m limit --limit 10/minute --limit-burst 1 -j LOG --log-prefix GOPH-DROP
|
517
|
511
|
|
518
|
512
|
# Limit IMAP connections
|
519
|
513
|
iptables -A INPUT -p tcp --dport 143 -m limit --limit 10/minute --limit-burst 1 -j ACCEPT
|
520
|
|
-iptables -A INPUT -p tcp --dport 143 -m limit --limit 10/minute --limit-burst 1 -j LOG --log-prefix IMAP-DROP
|
521
|
514
|
|
522
|
515
|
# Limit SIP connections
|
523
|
516
|
iptables -A INPUT -p tcp --dport 5060:5061 -m limit --limit 10/minute --limit-burst 1 -j ACCEPT
|
524
|
|
-iptables -A INPUT -p tcp --dport 5060:5061 -m limit --limit 10/minute --limit-burst 1 -j LOG --log-prefix SIP-DROP
|
525
|
517
|
|
526
|
518
|
# Limit SMTP/SMTPS connections
|
527
|
519
|
iptables -A INPUT -p tcp --dport 25 -m limit --limit 3/minute --limit-burst 1 -j ACCEPT
|
528
|
|
-iptables -A INPUT -p tcp --dport 25 -m limit --limit 3/minute --limit-burst 1 -j LOG --log-prefix SMTP-DROP
|
529
|
520
|
iptables -A INPUT -p tcp --dport 465 -m limit --limit 3/minute --limit-burst 1 -j ACCEPT
|
530
|
|
-iptables -A INPUT -p tcp --dport 465 -m limit --limit 3/minute --limit-burst 1 -j LOG --log-prefix SMTPS-DROP
|
531
|
521
|
|
532
|
522
|
# Limit Bitmessage connections
|
533
|
523
|
iptables -A INPUT -p tcp --dport 8444 -m limit --limit 10/minute --limit-burst 1 -j ACCEPT
|
534
|
|
-iptables -A INPUT -p tcp --dport 8444 -m limit --limit 10/minute --limit-burst 1 -j LOG --log-prefix BM-DROP
|
535
|
524
|
|
536
|
525
|
# Limit the number of incoming tcp connections
|
537
|
526
|
# Interface 0 incoming syn-flood protection
|