Am 03.05.2012 19:46, schrieb Paul W. Frields: > On Thu, May 03, 2012 at 04:21:20PM +0200, Reindl Harald wrote: >> is there any way to specify here more than one source-address >> (the usual comma seperated way does not work in this context) >> >> a complete ACCEPT before is no solution because it would bypass >> any selective ACCEPT-rule >> >> iptables -I INPUT -p tcp -i eth0 ! -s $LOCAL_NETWORK -m state --state NEW -m >> recent --set >> iptables -I INPUT -p tcp -i eth0 ! -s $LOCAL_NETWORK -m state --state NEW -m >> recent --update --seconds 1 --hitcount 75 -j REJECT --reject-with tcp-reset > > Even when you use comma-separated addresses (allowed when not using > the '!' operator), iptables actually creates separate rules in > response to the command. I believe that's what you need to do in this > situation
in theory yes but practically the reject of this rule would be triggered a secuity auditor from a customer is whining the he no longer can make security-scans and it will get hard to arue that we can not whitelist him in this case :-(
signature.asc
Description: OpenPGP digital signature
-- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
