Blokken via een firewall

Waarom

  • voorkomen van DoS
  • minder logvervuiling

Performance

  /usr/sbin/iptables -F smtp                                       # Create smtp chain
  /usr/sbin/iptables -X smtp
  /usr/sbin/iptables -N smtp
  /usr/sbin/iptables -A FORWARD -p tcp --dport 25 -j smtp          # Send smtp to its chain.
  for I in `seq 1 223`
  do
    /usr/sbin/iptables -F smtp${I}                                 # Create smtp chain per /8
    /usr/sbin/iptables -X smtp${I}
    /usr/sbin/iptables -N smtp${I}
    /usr/sbin/iptables -A smtp${I} -j ACCEPT                       # Default policy in this chain.
    /usr/sbin/iptables -A smtp --source      ${I}.0.0.0/8 -j smtp${I}
    /usr/sbin/iptables -A smtp --destination ${I}.0.0.0/8 -j smtp${I}
  done
  while read NET COMMENT
  do
    PREFIX="${NET%%\.*}"
    /usr/sbin/iptables -I smtp${PREFIX} --source $NET -j DROP      # Insert in smtp per /8 chain.
    /usr/sbin/iptables -I smtp${PREFIX} --destination $NET -j DROP # Insert in smtp per /8 chain.
  done < list-of-dossers