I have a FreeBSD system behind a Linux-based router (using DD-WRT firmware). The FreeBSD system is running sshd and is regularly probed by various script-kiddies.
It currently runs a script, that, upon seeing more than 3 failed attempts to login from the same IP-address, blocks the address completely. The block used to be local (using FreeBSD's ipfw), but I'd like to cover the entire LAN -- by asking the router to do the blocking. Which brings me to using Linux' means of firewalling -- the iptables.
If I use:
iptables -I INPUT -s $IP -j DROP
then the router will reject the IP trying to contact the router itself -- but will happily forward the connection to the LAN.
If I use
iptables -I FORWARD -s $IP -j DROP
it will stop attackers from reaching my LAN, but will keep the router reachable to them.
Is there some single rule -- or, at least, single command -- I can make for each attacking IP to intercept any and all traffic to and from it?
Thank you!
iptables -I FORWARD -s $IP -j DROP; iptables -I INPUT -s $IP -j DROP
count as a "single" command?iptables
rules are not expensive; I have many routers running with chains of 400-800 rules (for valid business reasons), plus ipsec tunnels and all the usual overhead, in 1GB of system memory - and they're fine. In addition, I believe it's a deliberate design decision by the netfilter people to pretty much completely separate the to/from-the-host and the through-the-host traffic inside the netfilter engine. Just use two rules and be done with it.