On Monday, October 15, 2018, 5:22:59 PM GMT+2, Tom Eastep <[email protected]> wrote:
>> >> DNAT net2:!+IPS_BL,+POL_BL,+GEO_BL,+GEOIPS_BL loc:10.215.145.81 >> tcp 80,443 - - 30/min:35 >> [...] >> ADD(POL_BL:src):info:polbl,add2polbl net1,net2,net3:!+POL_BL,+GLOBAL_WL >> all tcp,udp - !443,80,25,3389 > > > If the connection rate to ports 80 and 443 from the net exceeds the > LIMIT on the DNAT rule, then those connections exceeding the rate will > be added to the ipset. Interesting. So, if I want to make sure the SRC IP addr. is not added to my POL_BL ipset then I should either remove rate limiting or use something else in between. What about the following ruleset? DNAT net2:!+IPS_BL,+POL_BL,+GEO_BL,+GEOIPS_BL loc:10.215.145.81 tcp 80,443 - - 30/min:35 TARPIT(tarpit):info:polbl,limit net2 $FW tcp 80,443 [...] ADD(POL_BL:src):info:polbl,add2polbl net1,net2,net3:!+POL_BL,+GLOBAL_WL all tcp,udp - !443,80,25,3389 Or maybe just use the DROP action instead of TARPIT. So, I understand that those connections that exceed the rate limit will either be DROP'ped or TARPIT'ted but not ADD'ed to the ipset, right? Vieri _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
