--- /tmp/l3-saved-3972.14372.9638 2010-03-04 13:10:13.000000000 +0000
+++ /root/myfirewall.sh 2010-03-04 13:13:18.000000000 +0000
@@ -115,7 +115,8 @@
# Define a LOG and TARPIT custom chain:
iptables -N LnT
iptables -A LnT -p tcp -j LOG --log-prefix "LnT "
-iptables -A LnT -p tcp -j TARPIT
+# iptables -A LnT -p tcp -j TARPIT
+iptables -A LnT -p tcp -j REJECT
# Define a DDenial of Service custom chain:
iptables -N DDoS
@@ -179,7 +180,8 @@
iptables -A FTPl -j FTP
# Don't need to match new or syn because that's handled by the above rule:
# This may be too restrictive, so I reduced TARPIT from 2 to 3:
-iptables -A FTPl -p tcp -m statistic --mode nth --every 3 -j TARPIT
+# iptables -A FTPl -p tcp -m statistic --mode nth --every 3 -j TARPIT
+iptables -A FTPl -p tcp -m statistic --mode nth --every 3 -j REJECT
iptables -A FTPl -j RETURN
# * * * * * * * Here is where the filtering begins * * * * * * *
@@ -278,12 +280,12 @@
fi
# TARPIT these (/etc/firewall/tarpit must be executable):
-if [ -x /etc/firewall/tarpit ]; then
- while read TARP; do
- TARP=$(echo "$TARP" | awk '{print $1}')
- iptables -A INPUT -p tcp -s $TARP -j LnT
- done </etc/firewall/tarpit
-fi
+# if [ -x /etc/firewall/tarpit ]; then
+# while read TARP; do
+# TARP=$(echo "$TARP" | awk '{print $1}')
+# iptables -A INPUT -p tcp -s $TARP -j LnT
+# done </etc/firewall/tarpit
+# fi
# Limit new connection attempts from FTP leechers
# Can't TARPIT in the mangle table so squeeze 'em in INPUT <evil g>
@@ -347,7 +349,8 @@
# Low Ports:
# (Can't TARPIT udp)
-iptables -A INPUT -p tcp -m mport --dports 79,135,137:139,389,445,446,901,1002 -j TARPIT
+# iptables -A INPUT -p tcp -m mport --dports 79,135,137:139,389,445,446,901,1002 -j TARPIT
+iptables -A INPUT -p tcp -m mport --dports 79,135,137:139,389,445,446,901,1002 -j RdL
iptables -A INPUT -p udp -m mport --dports 79,135,137:139,389,445,446,901,1002 -j RdL
# This is "too many ports specified" because the max is 15 ports;
# IPT_MULTI_PORTS is set to 15 in ~linux/include/linux/netfilter_ipv4 for both
@@ -359,7 +362,8 @@
iptables -A INPUT -p udp --dport $LOWPORTS -j RdL
# Annoyance high ports:
-iptables -A INPUT -p tcp --sport $HI_PORTS -m mport --dports 1080,1433,3127:3128,4444,4899,6129,17300,20168 -j TARPIT
+# iptables -A INPUT -p tcp --sport $HI_PORTS -m mport --dports 1080,1433,3127:3128,4444,4899,6129,17300,20168 -j TARPIT
+iptables -A INPUT -p tcp --sport $HI_PORTS -m mport --dports 1080,1433,3127:3128,4444,4899,6129,17300,20168 -j RnL
# Take advantage of the stateful nature of iptables on the INPUT chain:
iptables -A INPUT -p tcp --dport ! 20:21 -m state --state $E_R -j ACCEPT
@@ -367,7 +371,8 @@
# * * Here is where the INPUT filtering ends and the policy takes effect * *
# INPUT chain: Just Say NO to everything not specifically allowed:
-iptables -A INPUT -p tcp -j TARPIT # Log so annoyance high ports can be
+# iptables -A INPUT -p tcp -j TARPIT # Log so annoyance high ports can be
+iptables -A INPUT -p tcp -j RnL # Log so annoyance high ports can be
# added to the TARPIT list. Naah, fuck em now not later. Was LnRi 19Feb04
iptables -A INPUT -j RdL # Can't TARPIT other than tcp which are
# dealt with in the prior rule. This REJECTs rather than DROPs, overriding the
