McUles
/
firmware
forked from freifunk-franken/firmware
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

firewall.user: Filter ssh brute force attacks 

Signed-off-by: Tim Niemeyer <tim.niemeyer@mastersword.de>
This commit is contained in:
Tim Niemeyer 2013-10-27 13:10:56 +01:00
parent 8b5c744a5d
commit 49bf540db4
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
bsp/default/root_file_system/etc/firewall.user
View File

@ -9,3 +9,6 @@ WAN=$(uci get network.wan.ifname)
iptables -A INPUT -i $WAN -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i $WAN -j REJECT
# Limit ssh to 3 new connections per 60 seconds
/usr/sbin/ip6tables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name dropbear
/usr/sbin/ip6tables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 3 --rttl --name dropbear -j DROP