31–40 of 46 posts
Not to detract from the article, but we should be using nftables in 2022. :-) https://wiki.nftables.org/wiki-nftables/index.php/Moving_fro...
He probably is in a way. iptables is now just a wrapper around nftables and nftables understand the iptables syntax.
ipset requires a separate kernel module.
Not to detract from the article, but we should be using nftables in 2022. :-) https://wiki.nftables.org/wiki-nftables/index.php/Moving_fro...
He probably is in a way. iptables is now just a wrapper around nftables and nftables understand the iptables syntax.
I've been using fail2ban to kill this for years. Seems to be quite effective: https://github.com/fail2ban/fail2ban
If possible, report the hosts you block using f2b to AbuseIPDB or similar projects. That way we'd be collectively better able to hinder this abuse.
Earlier quoted context omitted.
He probably is in a way. iptables is now just a wrapper around nftables and nftables understand the iptables syntax.
Where is that wrapper? In user space or in the kernel?
Not to detract from the article, but we should be using nftables in 2022. :-) https://wiki.nftables.org/wiki-nftables/index.php/Moving_fro...
He probably is in a way. iptables is now just a wrapper around nftables and nftables understand the iptables syntax.
Earlier quoted context omitted.
He probably is in a way. iptables is now just a wrapper around nftables and nftables understand the iptables syntax.
I always feel like a git telling people "it's nftables now!", but it's been over a decade and folks keep using iptables as the common identifier. It's slow to change language. You're right, many of those iptables commands are utilities/scripts around nftables now.
I work in IT and it is now probably 25 years that I keep hearing that IPv6 is round the corner. "Adoption" is ~35% but what this means that in 35% of the cases, you can get to a place though IPv6. This does not mean that you must, or do. It is just the capacity.
When a technology takes 25 or so years to be mainstream it means that there is a problem somewhere ("too complicated", ...) or that there is no problem in the forst place ("iptables work fine for me", "I NAT my 10.x network", ...)
On my internet facing hosts, I use the firehol level 2 and level 3 block sets along with blocking all CN IP space that I can accurately identify. My logs are eerily quiet.
I had some problems to get community support and it seems that activity around firehol is fading away and I am not sure whether this is because this is a complete, finished product, or because it is abandoned.