On Fri, Jan 30, 2004 at 12:13:18PM +0100, Alexander Dalloz wrote: > > /sbin/modprobe ip_conntrack_ftp &> /dev/null > > modprobe has the parameter "-q" to be quiet. Thanks, I didn't know. > > /sbin/iptables -F > > /sbin/iptables -X > > /sbin/iptables -P FORWARD DROP > > /sbin/iptables -P INPUT DROP > > To set policies to DROP and have no final REJECT rule is bad. DROP is no > good general rule. That's a matter of opinion, but for completion I do use rejects, but I tried to simplify the script: /sbin/iptables -A INPUT -p TCP -m limit --limit 20/minute -j REJECT --reject-with tcp-reset /sbin/iptables -A INPUT -p UDP -m limit --limit 20/minute -j REJECT --reject-with icmp-port-unreachable (I don't like the default reject method.) Regards, Luciano Rocha
