Skip to content
Register

My 'temporary' iptables rule lasted three years

General Discussion by MARIA3 22 replies 3.2K views
olespete

Member

Trust No One

#11

LOW13 said:
I block russia since 2021 for test and forget
And you are proud of this? What if you had a legitimate user? What if they used a VPN exit in Frankfurt? Geofiltering by country is security theater. I audit my rules weekly with a script. You should too.

airgapped, encrypted, faraday'd, still worried
LU

Member

#12

Same here Maria3! I have server in Barcelona and I block China for "temporary test" in 2022. Still there. My logs also empty but I think maybe I block too much, not sure. I should check.

playersofia

Member

#13

prague1983 said:
Just use nftables. Skill issue.
nftables has the same problem: you write a rule, you forget it, it stays. The syntax is nicer, the human is the same. IPv6 would solve this because nobody can enumerate a country block, so you wouldn't try.

frankfurt_ops

Member

#14

In Frankfurt we have a saying: the only temporary rule is the one you document. I use OPNsense at home, Hetzner cloud firewall at work — https://www.hetzner.com/cloud. Both send me a weekly email of active rules. Still managed to leave a port 8080 forward for 14 months. Documentation is hard.

prague1983

Member

btw I use Arch

#15

playersofia said:
IPv6 would solve this
IPv6 would solve nothing. I run Gentoo at home, I have IPv6, I still have a /48 from my ISP that hasn't changed in five years. Static enough to block if I wanted. Arch on the laptop, nftables on both, I sleep fine.

oops: 0000 [#1] SMP
MARIA3

Member OP

#16

LOW13 said:
Write notes. I use since two years now no problem
Yes! I start now with notes in /root/iptables-changes.txt with date. Simple but I think effective. Also I check my cron jobs, I find one from 2021 also "temporary" to restart service every hour. Service was deleted in 2022. Cron still running, doing nothing. Very funny.

siesta first, deploy later
BE

Member

3 #17

I use Contabo in Munich and their web firewall. No ssh to iptables, I forget nothing because I change nothing. Is this better? I don't know. But my temporary rules are their problem now.

LO

Member

5 #18

olespete said:
What if you had a legitimate user?
In Budapest we had a user from Russia in 2022. Real person, real payment. We blocked him by accident with country filter, he emailed from ProtonMail. Took three days to find the rule. Now I log every DROP to separate file and check monthly. Pain in the neck.

lucgone

Member

Le Baguette

#19

À Lyon on utilise Scaleway. Their console shows active rules with creation date, very nice. But I still have a "temporary" security group from 2022 blocking port 25. Email server moved to OVH in 2023. Rule still there, doing nothing, costing nothing. I am also guilty.

Vive la résistance... électrique
LO

Member

#20

olespete said:
Geofiltering by country is security theater
Maybe but it stop 99% of brute force on my SSH. I know fail2ban better, I use both. Country block is first layer, not only layer. My server in Romania, I block nothing from EU, only far away places. Works for me.

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft