Hello Benjamin,
On 04/01/2016 12:29 PM, Benjamin Lefoul wrote:
Hi!
I have inherited a system using the following in order to prevent SIPVicious attacks:
iptables -I INPUT -p udp --dport 5060 -m string --string "friendly-scanner" --algo bm -j DROP iptables -I INPUT -p tcp --dport 5060 -m string --string "friendly-scanner" --algo bm -j DROP
Now that we are migrating to firewalld, I am not quite sure how to translate this into the firewalld semantics.
Do I have to use a rich rule with "protocol value="?
Any idea?
As the string extension is not usable by firewalld, there is no way to add this in a rich rule. But it is possible to add direct rules for this. Direct rules can (since version 0.4.0) also be added to zones by using zone chains for the direct rules like for example IN_public_log, IN_public_deny and IN_public_allow. There is no automatism to select the proper chain by rule settings like table, chain and target yet.
In your case the proper chain should be IN_public_deny if you want to add the rule to the public zone only. Otherwise you could simply use INPUT_direct. Add the rule also in the permanent environment to have it also after reboot or restart of the service.
Thanks,
Benjamin Lefoul nWISE AB
firewalld-users mailing list firewalld-users@lists.fedorahosted.org https://lists.fedorahosted.org/admin/lists/firewalld-users@lists.fedorahoste...
Regards, Thomas