Hello Benjamin,
On 04/01/2016 12:29 PM, Benjamin Lefoul wrote:
Hi!
I have inherited a system using the following in order to prevent
SIPVicious attacks:
iptables -I INPUT -p udp --dport 5060 -m string --string
"friendly-scanner" --algo bm -j DROP
iptables -I INPUT -p tcp --dport 5060 -m string --string
"friendly-scanner" --algo bm -j DROP
Now that we are migrating to firewalld, I am not quite sure how to
translate this into the firewalld semantics.
Do I have to use a rich rule with "protocol value="?
Any idea?
As the string extension is not usable by firewalld, there is no way to
add this in a rich rule. But it is possible to add direct rules for
this. Direct rules can (since version 0.4.0) also be added to zones by
using zone chains for the direct rules like for example IN_public_log,
IN_public_deny and IN_public_allow. There is no automatism to select the
proper chain by rule settings like table, chain and target yet.
In your case the proper chain should be IN_public_deny if you want to
add the rule to the public zone only. Otherwise you could simply use
INPUT_direct. Add the rule also in the permanent environment to have it
also after reboot or restart of the service.
Thanks,
Benjamin Lefoul
nWISE AB
_______________________________________________
firewalld-users mailing list
firewalld-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/firewalld-users@lists.fedoraho...
Regards,
Thomas