* categorize directories to Dev or TipAndDoc

[lab.git] / iptables / ufw / raw.rules

diff --git a/iptables/ufw/raw.rules b/iptables/ufw/raw.rules
deleted file mode 100644 (file)
index f379716..0000000
--- a/iptables/ufw/raw.rules
+++ /dev/null
@@ -1,33 +0,0 @@
-#
-# This file is used by /etc/init.d/setfilter
-#
-# Rules that should be stored in raw table.
-# These are mainly used to filter evil or wrong packets.
-
-
-*raw
-:LOG_ICMP - [0:0]
-:LOG_SPOOF - [0:0]
-
-## LOG and DROP fragmented packets (not head fragments)
--A PREROUTING --fragment -j LOG --log-prefix "[UFW BLOCK FRAGMENTED]: " --log-level err -m limit --limit 3/min --limit-burst 10
--A PREROUTING --fragment -j DROP
-
-## LOG and DROP strange icmp packets
--A LOG_ICMP -j LOG --log-prefix "[UFW BLOCK BAD-ICMP]: " --log-level err -m limit --limit 3/min --limit-burst 10
--A LOG_ICMP -j DROP
-# Too large icmp requests
--A PREROUTING -p icmp --icmp-type echo-request -m length --length 128: -j LOG_ICMP
-# Too many times of icmp requests (only 5 packets per second if over 10pkts/sec)
--A PREROUTING -p icmp --icmp-type echo-request -m limit --limit 5/s --limit-burst 10 -j ACCEPT
--A PREROUTING -p icmp --icmp-type echo-request -j LOG_ICMP
-
-## LOG and DROP IP spoofing (eth1:WAN)
--A LOG_SPOOF -j LOG --log-prefix "[UFW BLOCK IP-SPOOFING]: " --log-level err -m limit --limit 3/min --limit-burst 10
--A LOG_SPOOF -j DROP
--A PREROUTING -i eth1 -s    127.0.0.0/8 -j LOG_SPOOF
--A PREROUTING -i eth1 -s     10.0.0.0/8 -j LOG_SPOOF
--A PREROUTING -i eth1 -s  172.16.0.0/12 -j LOG_SPOOF
--A PREROUTING -i eth1 -s 192.168.0.0/16 -j LOG_SPOOF
-
-COMMIT