Comment

Comment on Am I doing this (networking) safely?

I’m using RouterOS. In the firewall rules you can create a rule that if an IP touches a port, it get added to a address list (optional with a time-out). So my FW rules begin like this:

If source is whitelisted, Accept
If source IP is in the blacklist, drop all
if source IP tries to connect to port 21,22,25,137-139, 113 (and a bunch of others) add it to the blacklist
…
…

This too has endless possibilities. t.ex. like port knocking. (‘touch’ one or more ports in a specified sequence in a specified time to be allowed to access the actual service port)

source

Sort:hotnew top

non_burglar@lemmy.world ⁨1⁩ ⁨day⁩ ago
This is a waste of time and your router’s CPU. You already have a whitelist and know your safe TCP sources, just drop all wan traffic and only allow new input from whitelist. Your chain input rule is just creating a pretty list of bots you’re dropping anyway.

source
- redlemace@lemmy.world ⁨1⁩ ⁨day⁩ ago
  Well, here is the CPU load:
  
  Image
  
  And there is no increase on delay’s or jitter compared to what i’m already facing on the WAN itself.
  
  It keep’s 6000+ hosts with possible harmful intend away from the ports I need/want open to the world. Actually, the router -while still being bored- offloads the services behind it. I really can’t see a reason not to keep doing it. But, sure, it’s a personal choice.
  
  source
  - non_burglar@lemmy.world ⁨22⁩ ⁨hours⁩ ago
    Didn’t you say you have whitelist of allowed ips? Why don’t you just drop any other inbound traffic?
    
    source
    redlemace@lemmy.world ⁨21⁩ ⁨hours⁩ ago
    
    whitelist of allowed ips
    
    Not exactly.
    
    If source is whitelisted, Accept (avoid being locked out myself)
    
    So all IP’s are allowed to begin with, but some (“my” IP’s like at home, my office etc) are on a whitelist ahead of everything else. They can’t become blacklisted to avoid myself becoming locked out. Then it’s the drop all on the blacklisted, followed by portscan detection. Only after that the ‘normal’ rules (allow https, smtp etc) begin.
    
    source
Appoxo@lemmy.dbzer0.com ⁨1⁩ ⁨day⁩ ago
Off-topic: Looks like you missed the two spaces after beginning a new line.
Just wanted to inform you in case you werent aware ;)

source
- redlemace@lemmy.world ⁨1⁩ ⁨day⁩ ago
  the spacebar on my Remington isn’t what it used to be, maybe a drop of oil will help ;)
  
  source