Differences

This shows you the differences between two versions of the page.

--- linux:netzwerk:firewall [2023/04/20 15:34] – created ms
+++ linux:netzwerk:firewall [2023/11/05 21:54] (current) – ms
@@ Line 35: / Line 35: @@
 }
 </code>
+<code>
+nft list ruleset
+nft flush ruleset
+nft --check -f <ruleset-file>
+nft -f <ruleset-file>
+nft list rules
+nft list tables
+nft monitor [new | destroy] [tables | chains | sets | rules | elements] [xml | json]
+systemctl status nftables.service
+</code>
+Ruleset automatisch beim Booten starten
+<code>
+vi /etc/nftables.conf
+#!/usr/sbin/nft -f
+flush ruleset
+table inet filter {
+...
+</code>
+===== Brute Force auf ssh erschweren =====
+<code>
+add rule ip filter INPUT tcp dport 22 ct state new counter jump SSHBFORCE
+add chain ip filter SSHBFORCE
+add set ip filter denylist { type ipv4_addr; flags dynamic, timeout; timeout 5m }
+add rule ip filter SSHBFORCE ip protocol tcp ct state new, untracked limit rate over 3/minute add @denylist { ip saddr }
+add rule ip filter SSHBFORCE ip saddr @denylist drop
+</code>