Am 03.05.2012 19:46, schrieb Paul W. Frields:
On Thu, May 03, 2012 at 04:21:20PM +0200, Reindl Harald wrote:
> is there any way to specify here more than one source-address
> (the usual comma seperated way does not work in this context)
>
> a complete ACCEPT before is no solution because it would bypass
> any selective ACCEPT-rule
>
> iptables -I INPUT -p tcp -i eth0 ! -s $LOCAL_NETWORK -m state --state NEW -m recent
--set
> iptables -I INPUT -p tcp -i eth0 ! -s $LOCAL_NETWORK -m state --state NEW -m recent
--update --seconds 1 --hitcount 75 -j REJECT --reject-with tcp-reset
Even when you use comma-separated addresses (allowed when not using
the '!' operator), iptables actually creates separate rules in
response to the command. I believe that's what you need to do in this
situation
in theory yes
but practically the reject of this rule would be triggered
a secuity auditor from a customer is whining the he no longer
can make security-scans and it will get hard to arue that
we can not whitelist him in this case :-(