Robert Moskowitz wrote:
Tom Eastep wrote:Robert Moskowitz wrote:I have set my default rule to log info. I am seeing lots of probes on TCP port 22 and UDP port 1434. Does it make sense to put in specific rules to just drop these on the floor? I have mapped my SSH to a different port number.Configuring port-specific DROP rules is an option. I personally use another option for reducing log pollution:/etc/shorewall/blacklist: - udp 1024:1033,1434- tcp 57,1433,1434,2401,2745,3127,3306,3410,48############################################################################### #ADDRESS/SUBNET PROTOCOL PORT - udp 1024:1033,1434- tcp 22,57,1433,1434,2401,2745,3127,3306,3410,48Compiling /etc/shorewall/blacklist...WARNING: The entries in /etc/shorewall/blacklist have been ignored because there are no 'blacklist' interfaces : /etc/shorewall/blacklist (line 11)now what.
I guess you have better add the 'blacklist' option to your external interface as I showed in my initial post.
And that format that you supplied is not liked by Webmin.
Format of WHAT? -Tom -- Tom Eastep \ Nothing is foolproof to a sufficiently talented fool Shoreline, \ http://shorewall.net Washington USA \ [EMAIL PROTECTED] PGP Public Key \ https://lists.shorewall.net/teastep.pgp.key
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------- Check out the new SourceForge.net Marketplace. It's the best place to buy or sell services for just about anything Open Source. http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
