mark
/
firmware
forked from freifunk-franken/firmware
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fff-firewall: Add ipv4 ssh connection limit 

With commit [1] the ipv4 firewall on wan interface was removed.
This patch adds the ssh connection limit for ipv4.
IPv6 is already limited.

[1] 52e15e072c ("fff-firewall: Remove ssh firewall on WAN interface")

Signed-off-by: Robert Langhammer <rlanghammer@web.de>
Reviewed-by: Fabian Bläse <fabian@blaese.de>
[improve commit reference]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This commit is contained in:
Robert Langhammer 2021-02-12 01:55:20 +01:00 committed by Adrian Schmutzler
parent b98ba27690
commit 811fdac32d
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/packages/fff/fff-firewall/Makefile
View File

@ -1,7 +1,7 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=fff-firewall
PKG_RELEASE:=6
PKG_RELEASE:=7
include $(INCLUDE_DIR)/package.mk

2
src/packages/fff/fff-firewall/files/usr/lib/firewall.d/20-filter-ssh
View File

@ -1,3 +1,5 @@
# Limit ssh to 6 new connections per 60 seconds
/usr/sbin/ip6tables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name dropbear
/usr/sbin/ip6tables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 6 --rttl --name dropbear -j DROP
/usr/sbin/iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name dropbear
/usr/sbin/iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 6 --rttl --name dropbear -j DROP