Community discussions

MUM Europe 2020
 
blackmetal
Member Candidate
Member Candidate
Topic Author
Posts: 188
Joined: Mon Aug 16, 2010 9:01 am

translate rules , what these rules mean ?

Mon Nov 16, 2015 8:34 am

Hi,
i have following rules :
/ip firewall filter
add action=jump chain=forward connection-state=new jump-target=detect-ddos
add action=return chain=detect-ddos dst-limit=32,32,src-and-dst-addresses/10s
add action=add-dst-to-address-list address-list=ddosed address-list-timeout=10m chain=detect-ddos
add action=add-src-to-address-list address-list=ddoser address-list-timeout=10m chain=detect-ddos
add action=drop chain=forward connection-state=new dst-address-list=ddosed src-address-list=ddoser

my questions is :
1. if source ip from my network to outside (internet) create more than 32 connection per 10second will block and put in ddoser ip address group right?
2. if source ip from outside of my network (internet) create more than 32 connection per 10 seconds to my destion ip (to my network) will block and put in ddosed ip address group right?
3. i put my external and internal links to a bridge (because i want they work in transparent mode) so is above rules work fine for me in bridge mode ?
4. why action is jump and create dedicated firewall chain ? what is the benefit of dedicated firewall chain?
thanks,
 
User avatar
bajodel
Long time Member
Long time Member
Posts: 545
Joined: Sun Nov 24, 2013 8:30 am
Location: Italy

Re: translate rules , what these rules mean ?

Mon Nov 16, 2015 10:08 pm

.. my questions ..
Yes, yes, no (new connection has no meaning at layer2), less rules to evaluate
 
blackmetal
Member Candidate
Member Candidate
Topic Author
Posts: 188
Joined: Mon Aug 16, 2010 9:01 am

Re: translate rules , what these rules mean ?

Tue Nov 17, 2015 8:36 pm

hi,
what do you mean?
your mean is in bridge mode we can not control new connection limitation?
and we can only control new connection and invalid an destablished connectios?
thanks,
 
User avatar
bajodel
Long time Member
Long time Member
Posts: 545
Joined: Sun Nov 24, 2013 8:30 am
Location: Italy

Re: translate rules , what these rules mean ?

Fri Nov 20, 2015 12:59 am

..
your mean is in bridge mode we can not control new connection limitation? ..
At layer2 you have no "connections", only " packets " .? So no ..you can not control new connections
 
User avatar
chechito
Forum Guru
Forum Guru
Posts: 1747
Joined: Sun Aug 24, 2014 3:14 am
Location: Bogota Colombia
Contact:

Re: translate rules , what these rules mean ?

Fri Nov 20, 2015 2:34 am

you need to activate use ip firewall on bridge options
 
blackmetal
Member Candidate
Member Candidate
Topic Author
Posts: 188
Joined: Mon Aug 16, 2010 9:01 am

Re: translate rules , what these rules mean ?

Sat Nov 21, 2015 7:55 am

thanks all it seems when enable use ip firewall in bridge it passes connection state to firewall and we can control it,

Who is online

Users browsing this forum: No registered users and 72 guests