Masse an Benachrichtigungen tunen (speziell WARN-856)

Hallo Marc,

(Sorry, my German-speaking brain isn't creating thoughts at the moment. [:(])

Yeah, this had really gotten painful for one site at one of my clients.  It's mostly attacks from what I assume is Chinese military hackers looking for any way to infiltrate.  Just for fun (and at no charge), I made a Network Group "All Portscanners" containing the subnets of IPs that have scanned this site.  I made a port scanning Exception for the members of this group and created a firewall Reject rule for them so that the traffic would be blocked silently and that the bad guys would get a slap in the face.

That group is up to 49 subnets.  In the first three days of October, 1004 offending packets were rejected.  Now, I add one Network a week to the Group as opposed to one or two a day as I did when I first started in mid-July.

August was the biggest month for rejections with over 22K packets rejected and just short of 9K in September.

I suspect the Reject rule resulted in many new portscanning attacks from other subnets controlled by the same bad guys, so you may just want to use a Drop rule instead.

MfG - Bob (Bitte auf Deutsch weiterhin.)

Hallo Marc,

(Sorry, my German-speaking brain isn't creating thoughts at the moment. [:(])

Yeah, this had really gotten painful for one site at one of my clients.  It's mostly attacks from what I assume is Chinese military hackers looking for any way to infiltrate.  Just for fun (and at no charge), I made a Network Group "All Portscanners" containing the subnets of IPs that have scanned this site.  I made a port scanning Exception for the members of this group and created a firewall Reject rule for them so that the traffic would be blocked silently and that the bad guys would get a slap in the face.

That group is up to 49 subnets.  In the first three days of October, 1004 offending packets were rejected.  Now, I add one Network a week to the Group as opposed to one or two a day as I did when I first started in mid-July.

August was the biggest month for rejections with over 22K packets rejected and just short of 9K in September.

I suspect the Reject rule resulted in many new portscanning attacks from other subnets controlled by the same bad guys, so you may just want to use a Drop rule instead.

MfG - Bob (Bitte auf Deutsch weiterhin.)

Hallo Bob,

klingt zwar nicht nach einer Lösung ;-) aber klingt auch nicht verkehrt ;-)
Schöner wäre es aber bzgl. der Meldungen wenn das Begrenzen einfach seinen Dienst versehen würde...

I prefer a blackhole routing with DNAT instead - this also blocks access tries to the regular running services (like https)

Hi papa, can you explain that a little bit to me?