nicholas/showcase
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

more changes

Browse Source
This commit is contained in:
nicholasmanios
2020-03-18 16:02:23 -04:00
parent 65104e0cdd
commit 54b07433a5
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
aries/firewall/README.md
View File

@@ -8,4 +8,10 @@ Since I want this server to be as close a _router replacement_ as possible, I wa
I also wanted to ensure that this machine will be the only place that any device on my local network goes to for DNS lookup. To do this, I created a `/etc/pf_public_dns.table` IP table containing the most popular public DNS servers. Any device that tries to connect to one of these servers will get routed to my DNS server (located on the aries as well). I also wanted to ensure that this machine will be the only place that any device on my local network goes to for DNS lookup. To do this, I created a `/etc/pf_public_dns.table` IP table containing the most popular public DNS servers. Any device that tries to connect to one of these servers will get routed to my DNS server (located on the aries as well).
## VPN ## VPN
Currently pf manages connecting the routes to and from the OpenVPN network (`10.8.0.0/16`), however this will be changed in the future as I am currently migrating from OpenVPN to Wireguard. Currently pf manages connecting the routes to and from the OpenVPN network (`10.8.0.0/16`), however this will be changed in the future as I am currently migrating from OpenVPN to Wireguard.
## Spam IP Blocklist
There are plans in the future to incorporate IP blocking of spammers in pf. This should be moved to the firewall of hermes so that aries does not lose the definition of _router replacement_.
## Abusive IP Blocklist
You may notice `BLOCKTEMP` and `BLOCKPERM` tables. These tables are used to block abusive hosts. The abusive hosts are determined from the number of bad requests to my web server. If an IP has > 10 4xx/5xx responses with a 24 hour period it gets added to the `BLOCKTEMP` table.