<html><head></head><body>Thankyou-from: SebaBe ;) <br><br><div class="gmail_quote">Am 2. August 2020 20:55:49 MESZ schrieb Robert Langhammer <rlanghammer@web.de>:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">Hi Fabian,<br><br>hat mich auch schon manchmal genervt.<br><br>Reviewed-by: Robert Langhammer <rlanghammer@web.de><br><br>Am 02.08.20 um 19:55 schrieb Fabian Bläse:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> This firewall was introduced as a countermeasure for very slow routers<br> directly connected to the internet without any firewall.<br><br> Our routers have got quite a bit faster since then. Also, a setup like<br> this is highly uncommon, especially for slower routers.<br><br> Therefore this firewall rule is removed.<br><br> Fixes: #138<br> Signed-off-by: Fabian Bläse <fabian@blaese.de><hr> .../fff/fff-firewall/files/usr/lib/firewall.d/20-filter-ssh | 6 ------<br> 1 file changed, 6 deletions(-)<br><br> diff --git a/src/packages/fff/fff-firewall/files/usr/lib/firewall.d/20-filter-ssh b/src/packages/fff/fff-firewall/files/usr/lib/firewall.d/20-filter-ssh<br> index aa04ce9..bb18657 100644<br> --- a/src/packages/fff/fff-firewall/files/usr/lib/firewall.d/20-filter-ssh<br> +++ b/src/packages/fff/fff-firewall/files/usr/lib/firewall.d/20-filter-ssh<br> @@ -1,9 +1,3 @@<br> -# If an router has a direct internet connection simple attack act as DOS attack<br> -if [ -n "$IF_WAN" ]; then<br> - iptables -A INPUT -i $IF_WAN -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT<br> - iptables -A INPUT -i $IF_WAN -j REJECT<br> -fi<br> -<br> # Limit ssh to 6 new connections per 60 seconds<br> /usr/sbin/ip6tables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set --name dropbear<br> /usr/sbin/ip6tables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 6 --rttl --name dropbear -j DROP<br></blockquote></pre></blockquote></div></body></html>