Re: [gentoo-security] [OT?] automatically firewalling off IPs

[Brian Micek <bmicek@speakeasy.net>]

[-- Attachment #1.1.1: Type: text/plain, Size: 1388 bytes --]

Attached are my scripts I generate in a cron job to block China and
Korea if anyone is interested.  I've observed the CIDRs to these
countries change so it might be a good idea to have semi-recent copies. 

Brian 

On Thu, 2005-10-06 at 15:02 -0600, Kirk Hoganson wrote:

> Matan Peled said the following:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> > 
> > William Kenworthy wrote:
> > 
> >>Can anyone comment whether IP spoofing (for hiding country of origin) is
> >>common?  Seems quite unlikely - at least at the current state of things.
> >>Is it even possible to tell (at the firewall interface?)
> >>
> >>BillK
> > 
> > 
> > I think that for hiding country of origin by IP spoofing is quite useless, at
> > least on the Internet (It might work on a single subnet, or if you pretend to be
> > another IP in your subnet, and then switches complicate it as well...)
> > 
> 
> I think it depends on your purpose.  It is easy to get around, but 
> blocking whole ranges based on country could help cut down on the 
> vulerability scans that can be so annoying.  Our country does no 
> business with China, yet various subnets are frequently scanned from 
> addresses originating there.  Blocking those ranges would cause most of 
> them to move on.  It is likely that you already block whole invalid 
> subnets in your firewall rules anyway.

[-- Attachment #1.1.2: Type: text/html, Size: 2405 bytes --]

[-- Attachment #1.2: block-cn.sh --]
[-- Type: application/x-shellscript, Size: 35946 bytes --]

[-- Attachment #1.3: block-kr.sh --]
[-- Type: application/x-shellscript, Size: 21195 bytes --]

[-- Attachment #1.4: undo-block-cn.sh --]
[-- Type: application/x-shellscript, Size: 35920 bytes --]

[-- Attachment #1.5: undo-block-kr.sh --]
[-- Type: application/x-shellscript, Size: 21169 bytes --]

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]