[Dark_Shadow]

I am getting hammered on my http server and have added what I thought was the right subnet to asia.spam, stopped and restarted asiablock, yet It still persists.

Culprit = 193.170.211.203

Subnet = 193.170.208.0/22

Is this right?

[Masterman]

[Dark_Shadow]

still getting past..

[buddee]

[Dark_Shadow]

[Dark_Shadow]

I don't understand, I've tried both ways and I know that asiablock is doing something with it cause it adds entries next to the subnet I have added. But nether is blocking that ip address.


EDIT:

193.170.208.0/22 in asia.spam is working. the ip address is being blocked. don't understand why it took so long.

[frater]

[niagafall]

So I noticed that someone was trying to get in through ssh and I wanted to block the ip.

Following the example I did:
echo 217.219.115.0/18>>/opt/etc/asia.spam
and checked to see its in /opt/etc/asia.spam
then restarted firewall with service asiablock start

but now when i check the file /opt/etc/asia.spam the entry I put there is gone, and when i grep iptables I dont see the ip starting with 217 at all.

Any idea what Im doing wrong?

Thanks

[Masterman]

[Vess]

I installed optware and want to run asiablock and stophammer I enabled the services and then I start asiablock. The script does some activity and then it ends with

S95asiablock: /opt/etc/iptables.asia is not executed in rc_firewall, I will add it!
S95asiablock: Stop iptables
S95asiablock: Start iptables
Bad argument `NEW'
S95asiablock: It took 6 seconds to load 367 rules into iptables

I check iptables and there is nothing added. Same error happens when I disable asiablock or stophammer services

S95asiablock: iptables.asia will be removed from rc_firewall
S95asiablock: Stop iptables
S95asiablock: Start iptables
Bad argument `NEW'

Any ideas? Thanks in advance.

[frater]

[Vess]

I will give it a try and let you know. Thanks

[frater]

[cedriclille]

Hello,

I try to put this firewall script, using OPTRW asterisk and asiablock based on Frater's script.

/opt/etc/init.d/S90asterisk restart
wanf=`nvram get wan_iface`
iptables -I INPUT 2 -i $wanf -p udp --dport 5060 -j logdrop
iptables -I INPUT 2 -i $wanf -p udp --dport 5060 -m state --state NEW -m limit --limit 3/min -j logaccept
iptables -I INPUT 2 -i $wanf -p udp -j world
iptables -I INPUT -p udp -i $wanf --dport 12000:13000 -j ACCEPT
iptables -I INPUT -p udp -i $wanf --dport 2727 -j ACCCEPT
iptables -I FORWARD 1 -i $wanf -p tcp --dport 20:1024 -j asia
iptables -D FORWARD `iptables --line-numbers -nL FORWARD | grep ESTABLISHED | tail -n1 | awk '{print $1}'`
iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

My goals are :

- access asterisk outside from my Lan but only from France (I modified S95asiablock with "noAsia="fr")
- try to block bruteforce Asterisk hacks with limiting connections attempts to 3/mn.


This morning I had a brute force attack from UK [213.174.xxx.xxx] ...

Where am I wrong ... Is Frater somewhere out there ??

Thanks

[Masterman]