3 articles iptables

kernel: conntrack: generic helper won’t handle protocol 47.

I was getting the following message in my log files on my Debian firewall. kernel: conntrack: generic helper won’t handle protocol 47. Please consider loading the specific helper module. The nf_conntrack_proto_gre module needs to be loaded to resolve this. modprobe nf_conntrack_proto_gre To load it automatically at boot, I created a new file (gre.conf) in /etc/modules-load.d…

Blocking bogons with iptables

ipsets is a fairly recent addition to the netfilter family. It is possible to define networks / addresses and then use them in iptables. ipset –create bogons nethash ipset –add bogons 10.0.0.0/8 ipset –add bogons 192.168.0.0/16 ipset –add bogons 0.0.0.0/8 ipset –add bogons 169.254.0.0/16 ipset –add bogons 172.16.0.0/12 ipset –add bogons 192.0.2.0/24 ipset –add bogons…