Just to mention it...

Since my machine is shared serving also a public IP, I also do some rate limiting on most "hacked" tcp ports:

PORT_RATE_LIMIT="ssh smtp smtps pop3 pop3s"

# rate limiting against brute force & DDOS # echo -n "Adding IPv4 input connection rate limiting: " for port in $PORT_RATE_LIMIT ; do iptables -A INPUT -p tcp --dport $port -m state --state NEW -m recent --set iptables -A INPUT -p tcp --dport $port -m recent --update --seconds 60 --hitcount 8 -j DROP echo -n "$port " done echo ""

Marius, YO2LOJ

Marius; Have, but from spoofed 44-net ips.

Sent through via axMail-fax by N1URO.

Sent with AquaMail for Android http://www.aqua-mail.com

On September 29, 2014 2:39:04 PM "Marius Petrescu" marius@yo2loj.ro wrote:

(Please trim inclusions from previous messages) _______________________________________________

---

Actually, droping anything not from 44/8 from the tunnel(s) is quite effective :-) Haven't seean any attack from a 44 address (yet?)...

-----Original Message----- From: 44net-bounces+marius=yo2loj.ro@hamradio.ucsd.edu [mailto:44net-bounces+marius=yo2loj.ro@hamradio.ucsd.edu] On Behalf Of sp2lob@tlen Sent: Monday, September 29, 2014 20:36 To: AMPRNet working group Subject: Re: [44net] Apache2 log - suspicious entries...

(Please trim inclusions from previous messages) _______________________________________________ Hello Brian(N1URO) et al.

My list of "abusing" subnets and single IP's contains 56 lines and still grows almost every day. All of them blocked continuously by iptables.

For securing all amprnet interfaces I have one PERFECT cure:

-A INPUT ! -s 44.0.0.0/8 -i tunl0 -j DROP -A INPUT ! -s 44.0.0.0/8 -i tun0 -j DROP -A INPUT ! -s 44.0.0.0/8 -i tun1 -j DROP -A INPUT ! -s 44.0.0.0/8 -i tun2 -j DROP -A INPUT ! -s 44.0.0.0/8 -i sl0 -j DROP -A INPUT ! -s 44.0.0.0/8 -i sl1 -j DROP -A INPUT ! -s 44.0.0.0/8 -i sl2 -j DROP

Really deadly weapon, Hi!

Nothing, literally nothing, what isn't originated from 44 network is explicitly DROPped. JNOS-2.0j4, TNOS-2.40, OpenVPN(44net), TNOS-3.01a1 and two (X)net's are as safe as never before.

Sending email to the "abuse" mailbox is nice and pollite way but do not change situation right away. Just my personal point of view...

One day somebody said: if I run taxi business, say in Texas, I do not want customer from LaLaLand poking around!

Best regards. Tom - sp2lob

Send from Sony Xperia Z1 http://www.aqua-mail.com

---

44Net mailing list 44Net@hamradio.ucsd.edu http://hamradio.ucsd.edu/mailman/listinfo/44net

---

---

44Net mailing list 44Net@hamradio.ucsd.edu http://hamradio.ucsd.edu/mailman/listinfo/44net