Re: iptables recent / more than one exception

[Reindl Harald <h.reindl@xxxxxxxxxxxxx>]

Am 03.05.2012 19:46, schrieb Paul W. Frields:
> On Thu, May 03, 2012 at 04:21:20PM +0200, Reindl Harald wrote:
>> is there any way to specify here more than one source-address
>> (the usual comma seperated way does not work in this context)
>>
>> a complete ACCEPT before is no solution because it would bypass
>> any selective ACCEPT-rule
>>
>> iptables -I INPUT -p tcp -i eth0 ! -s $LOCAL_NETWORK -m state --state NEW -m recent --set
>> iptables -I INPUT -p tcp -i eth0 ! -s $LOCAL_NETWORK -m state --state NEW -m recent --update --seconds 1 --hitcount  75 -j REJECT --reject-with tcp-reset
> 
> Even when you use comma-separated addresses (allowed when not using
> the '!' operator), iptables actually creates separate rules in
> response to the command.  I believe that's what you need to do in this
> situation

in theory yes
but practically the reject of this rule would be triggered

a secuity auditor from a customer is whining the he no longer
can make security-scans and it will get hard to arue that
we can not whitelist him in this case :-(

Attachment: signature.asc
Description: OpenPGP digital signature

-- 
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org