Changes between Version 8 and Version 9 of HowTo/SakuraVpsSetup3

Timestamp:

Apr 29, 2017, 6:47:06 AM (8 years ago)

Author:

村山 俊之

Comment:

--

HowTo/SakuraVpsSetup3

@@ -138 +138 @@
 /sbin/iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
 /sbin/iptables -A FORWARD -j REJECT --reject-with icmp-port-unreachable
+
+# SNMP blocking
+/sbin/iptables -A OUTPUT -m udp -p udp -m multiport --dports 161,162 -j REJECT --reject-with icmp-port-unreachable
 }}}
 {{{
@@ -164 +167 @@
 /sbin/ip6tables -A INPUT -j REJECT --reject-with icmp6-port-unreachable
 /sbin/ip6tables -A FORWARD -j REJECT --reject-with icmp6-port-unreachable
+
+# SNMP blocking
+/sbin/ip6tables -A OUTPUT -m udp -p udp -m multiport --dports 161,162 -j REJECT --reject-with icmp6-port-unreachable
 }}}
 {{{
@@ -186 +192 @@
 Chain OUTPUT (policy ACCEPT)
 target     prot opt source               destination         
+REJECT     udp  --  0.0.0.0/0            0.0.0.0/0            udp multiport dports 161,162 reject-with icmp-port-unreachable
 # ip6tables -L -n
 Chain INPUT (policy ACCEPT)
@@ -201 +208 @@
 Chain OUTPUT (policy ACCEPT)
 target     prot opt source               destination         
-#
+REJECT     udp      ::/0                 ::/0                 udp multiport dports 161,162 reject-with icmp6-port-unreachable
+# 
 }}}
  1. iptables-persistent をインストールし、iptables の設定を保存する
@@ -211 +219 @@
 {{{
 # cat /etc/iptables/rules.v4
-# Generated by iptables-save v1.6.0 on Fri Apr 28 17:47:41 2017
+# Generated by iptables-save v1.6.0 on Sat Apr 29 06:40:35 2017
 *filter
 :INPUT ACCEPT [0:0]
 :FORWARD ACCEPT [0:0]
-:OUTPUT ACCEPT [234:24432]
+:OUTPUT ACCEPT [283:43644]
 -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A INPUT -p icmp -j ACCEPT
@@ -222 +230 @@
 -A INPUT -j REJECT --reject-with icmp-port-unreachable
 -A FORWARD -j REJECT --reject-with icmp-port-unreachable
+-A OUTPUT -p udp -m udp -m multiport --dports 161,162 -j REJECT --reject-with icmp-port-unreachable
 COMMIT
-# Completed on Fri Apr 28 17:47:41 2017
+# Completed on Sat Apr 29 06:40:35 2017
 # cat /etc/iptables/rules.v6
-# Generated by ip6tables-save v1.6.0 on Fri Apr 28 17:47:41 2017
+# Generated by ip6tables-save v1.6.0 on Sat Apr 29 06:40:35 2017
 *filter
 :INPUT ACCEPT [0:0]
 :FORWARD ACCEPT [0:0]
-:OUTPUT ACCEPT [106:10896]
+:OUTPUT ACCEPT [0:0]
 -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A INPUT -p icmp -j ACCEPT
@@ -236 +245 @@
 -A INPUT -j REJECT --reject-with icmp6-port-unreachable
 -A FORWARD -j REJECT --reject-with icmp6-port-unreachable
+-A OUTPUT -p udp -m udp -m multiport --dports 161,162 -j REJECT --reject-with icmp6-port-unreachable
 COMMIT
-# Completed on Fri Apr 28 17:47:41 2017
-#
+# Completed on Sat Apr 29 06:40:35 2017
+# 
 }}}