This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Block DNAT for some IPs

Hello my friends,

Is it possible to block an IP when it is trying to get information from a Public IP which is configured in DNAT ?

I´m trying to block an IP, I created a packet filter rule but this user is still trying to enter through the DNAT. The malicious IP is public too.

I checked DNAT configuration for reject options but didn´t see anything...what else can I do ?

thanks...

This thread was automatically locked due to age.

0 BAlfson over 13 years ago

Like most everything in Astaro, NAT rules are processed in sequence. Create a new DNAT above your current one: '{malicious IP} -> Any -> External (Address) : DNAT to {non-existant IP}'.

Did that work for you?

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 samuel.lao85 over 13 years ago

Thanks mate...

I will try it and notify the results....
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 13 years ago

Or turn off 'auto packetfilter rule' and use PacketFilter rules to block, before the Allow rules.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 samuel.lao85 over 13 years ago

Hi,

Last 3 days I´ve been monitoring the suspicious IP and I haven´t see it on my logs, so the DNAT for a non-existing IP works well.

Thanks for your help and time my friends....
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 13 years ago

Just don't forget it's there if you're ever trying to diagnose something.

I personally find it easier to have everything on the PacketFilter page, so my DNATs and SNATs are unrestrictive.

Barry
Cancel
Vote Up 0 Vote Down

Cancel