[SOVLED by '!' ]how to specify IP not equal to in iptables rules ????

[J.Witvliet at mindef.nl]

________________________________
From: users-bounces at lists.fedoraproject.org [mailto:users-bounces at lists.fedoraproject.org] On Behalf Of James Hogarth
Sent: Friday, July 15, 2011 11:41 AM
To: Community support for Fedora users
Subject: Re: [SOVLED by '!' ]how to specify IP not equal to in iptables rules ????


>
> '!' Solved my problem
>

Perhaps for the people reading the thread on this list....
It is not a good thing the have the policy of iptables set to "accept", and drop what you want.
If you ever misses one port, you are as vulnerable as you would have been without any rules.

Better approach is:

1)  to set the policy to drop everything,

2) allow what is needed,

4) log everything else.

If you find you log gets to bulky, you can introduce stap 3) to drop traffic from specific port&address before everything else is logged.



In this way, everything that you forgets, will be logged & dropped, instead of allowed in.



hw




______________________________________________________________________
Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het elektronisch verzenden van berichten.

This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.fedoraproject.org/pipermail/users/attachments/20110718/3bbe9a54/attachment.html