My test XS at home has a FQDN and is open to the outside. Therefore this is probably a pretty rare issue in XS land, but I thought I'd ask.
I noticed my "ambient" rx/tx traffic on eth0 had gone from really low (like 0.1 to 0.7 kB/s) to hovering between 5-20 kB/s. I went through httpd's access_log and error_log and blocked a bunch of IPs that looked kinda sketchy. Chinese and Russian search engine bots, script kiddies looking for phpmyadmin, that kinda stuff. Of course, I do have robots.txt disallowing all user agents, but we know that's not always respected. Then I thought, rather than play whack-a-mole with individual IPs, I'll just block China and Russia altogether. However, that brings up another question. Between China: http://www.wizcrafts.net/chinese-iptables-blocklist.html and Russia: http://www.wizcrafts.net/russian-iptables-blocklist.html that's a ton of IP addresses. Getting them into /etc/sysconfig/olpc-scripts/iptables-xs is easy enough. I pasted the IP data into a file named banned_ips.txt and ran this little script: #!/bin/bash for i in $(< banned_ips.txt); do iptables -A INPUT -s "$i" -j DROP done I didn't mess with iptables-xs.in, as I figured I might need to update and/or straighten stuff out and a simple IP list is a lot easier to manipulate. Of course, restarting iptables reloads iptables-xs.in and the block list is gone from iptables-xs. No big deal, as the above script just takes a couple seconds to run and they're back in there. Here's my question - is the XS networking going to get wonky with 894 extra iptables rules? I know every incoming connection has to be checked against it, so what's the max count of rules that's a good idea? And is there a better way to handle this? Anna Schoolfield Birmingham P.S. After blocking all these IPs, my ambient traffic has gone back down to normal.
_______________________________________________ Server-devel mailing list Server-devel@lists.laptop.org http://lists.laptop.org/listinfo/server-devel