guysopk.blogg.se

NOTE: These steps are for servers that are not RackConnect® cloud servers.įor RackConnect, make changes in the dedicated firewall. Administrative access to your server by using the sudo command.Basic understanding of Secure Shell (SSH).Basic understanding of commands in a Linux operating.The commands to block an IP address on three common Linux® software firewalls. # Can be used to further restrict a global FORWARD policy set to allow - ufw : rule : deny route : yes src : 1.2.3.0/24 dest : 4.5.6.A large number of requests from one IP address can deplete # Note that IPv6 must be enabled in /etc/default/ufw for IPv6 firewalling to work. Either use delete=yes # or a separate state=reset task) - ufw : rule : allow name : OpenSSH # Delete OpenSSH rule - ufw : rule : allow name : OpenSSH delete : yes # Deny all access to port 53: - ufw : rule : deny port : 53 # Allow port range 60000-61000 - ufw : rule : allow port : '60000:61000' # Allow all access to tcp port 80: - ufw : rule : allow port : 80 proto : tcp # Allow all access from RFC1918 networks to this host: - ufw : rule : allow src : ' ' with_items : - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 # Deny access to udp port 514 from host 1.2.3.4: - ufw : rule : deny proto : udp src : 1.2.3.4 port : 514 # Allow incoming access to eth0 from 1.2.3.5 port 5469 to 1.2.3.4 port 5469 - ufw : rule : allow interface : eth0 direction : in proto : udp src : 1.2.3.5 from_port : 5469 dest : 1.2.3.4 to_port : 5469 # Deny all traffic from the IPv6 2001:db8::/32 to tcp port 25 on this host. (Note that as ufw manages its own state, simply removing # a rule=allow task can leave those ports exposed. Typical usage is: - ufw : rule : limit port : ssh proto : tcp # Allow OpenSSH. ufw will deny connections if an IP # address has attempted to initiate 6 or more connections in the last # 30 seconds. In addition, log rejected connections: - ufw : rule : reject port : auth log : yes # ufw supports connection rate limiting, which is useful for protecting # against brute-force login attacks. In these cases, use # reject instead of deny. # Allow everything and enable UFW - ufw : state : enabled policy : allow # Set logging - ufw : logging : on # Sometimes it is desirable to let the sender know when traffic is # being denied, rather than simply ignoring it.