<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<TITLE>Message</TITLE>
<META content="MSHTML 6.00.2900.2873" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=279591319-22052006><FONT face=Arial>Dear
All,</FONT></SPAN></DIV>
<DIV><FONT face=Arial><SPAN class=279591319-22052006><FONT
face=Arial></FONT></SPAN></FONT> </DIV>
<DIV><SPAN class=279591319-22052006><FONT face=Arial>Being rather sick of idiots
who can't be bothered to secure their PCs and host worms, viruses and other
malware, I installed the TARPIT (</FONT><A
href="http://www.netfilter.org/patch-o-matic/pom-extra.html#pom-extra-TARPIT)"><FONT
face=Arial>http://www.netfilter.org/patch-o-matic/pom-extra.html#pom-extra-TARPIT)</FONT></A><FONT
face=Arial> destination for iptables on my router.</FONT></SPAN></DIV>
<DIV><FONT face=Arial><SPAN class=279591319-22052006><FONT
face=Arial></FONT></SPAN></FONT> </DIV>
<DIV><SPAN class=279591319-22052006><FONT face=Arial>I fiddled around quite a
lot with custom rules in firehol, but could quite get the behaviour from the
iptables that I wanted and so was forced to modify the source. I've added a new
keyword "tarpit" which works rather like the "protection" keyword. It takes no
parameters, and is used when finalising an interface or router chain. When
present, this keyword causes all unmatched tcp traffic to be sent to the
tarpit.</FONT></SPAN></DIV>
<DIV><FONT face=Arial><SPAN class=279591319-22052006><FONT
face=Arial></FONT></SPAN></FONT> </DIV>
<DIV><SPAN class=279591319-22052006><FONT face=Arial>The diff is
below.</FONT></SPAN></DIV>
<DIV><FONT face=Arial><SPAN class=279591319-22052006><FONT
face=Arial></FONT></SPAN></FONT> </DIV>
<DIV><SPAN class=279591319-22052006><FONT face=Arial>Regards</FONT></SPAN></DIV>
<DIV><FONT face=Arial><SPAN class=279591319-22052006><FONT
face=Arial></FONT></SPAN></FONT> </DIV>
<DIV><SPAN class=279591319-22052006><FONT face=Arial>Nicole</FONT></SPAN></DIV>
<DIV><SPAN class=279591319-22052006><FONT face=Arial></FONT></SPAN> </DIV>
<DIV><SPAN class=279591319-22052006><FONT face=Arial>An example of the use in a
config file</FONT></SPAN></DIV>
<DIV><SPAN class=279591319-22052006><FONT
face=Arial>~~~~~~~~~~~~~~~~~~~~~~~~~~~~</FONT></SPAN></DIV>
<DIV><SPAN class=279591319-22052006><FONT face=Arial></FONT></SPAN> </DIV>
<DIV><SPAN class=279591319-22052006><FONT face=Arial>interface ppp0 outside src
not ${UNROUTABLE_IPS}</FONT></SPAN></DIV>
<DIV><SPAN class=279591319-22052006><FONT face=Arial> policy
drop</FONT></SPAN></DIV>
<DIV><SPAN class=279591319-22052006><FONT face=Arial>
tarpit</FONT></SPAN></DIV>
<DIV><SPAN class=279591319-22052006><FONT face=Arial> ...
</FONT></SPAN></DIV>
<DIV><SPAN class=279591319-22052006><FONT face=Arial></FONT></SPAN> </DIV>
<DIV><SPAN class=279591319-22052006><FONT face=Arial>router outside_int inface
ppp0 outface eth0 src @${UNROUTABLE_IPS} dst
"192.168.0.0/24"</FONT></SPAN></DIV>
<DIV><SPAN class=279591319-22052006><FONT face=Arial> protection
strong</FONT></SPAN></DIV>
<DIV><SPAN class=279591319-22052006><FONT face=Arial>
tarpit</FONT></SPAN></DIV>
<DIV><SPAN class=279591319-22052006><FONT face=Arial> route http
accept</FONT></SPAN></DIV>
<DIV><FONT face=Arial><SPAN class=279591319-22052006><FONT face=Arial>
...</FONT></SPAN></FONT></DIV>
<DIV><FONT face=Arial><SPAN class=279591319-22052006></SPAN></FONT> </DIV>
<DIV><FONT face=Arial><SPAN class=279591319-22052006>The diff
is</SPAN></FONT></DIV>
<DIV><FONT face=Arial><SPAN
class=279591319-22052006>~~~~~~~~</SPAN></FONT></DIV>
<DIV><SPAN class=279591319-22052006><FONT size=2><FONT face=Arial
size=3></FONT> </DIV>
<DIV><FONT face=Arial size=3>--- firehol 2006-05-22 10:44:17.000000000
+0100</FONT></DIV>
<DIV><FONT face=Arial size=3>+++ firehol.new 2006-05-22 10:46:46.000000000
+0100</FONT></DIV>
<DIV><FONT face=Arial size=3>@@ -410,6 +410,7 @@</FONT></DIV>
<DIV><FONT face=Arial
size=3>work_policy="${DEFAULT_INTERFACE_POLICY}"</FONT></DIV>
<DIV><FONT face=Arial size=3>work_error=0</FONT></DIV>
<DIV><FONT face=Arial size=3>work_function="Initializing"</FONT></DIV>
<DIV><FONT face=Arial size=3>+work_tarpit=0</FONT></DIV>
<DIV><FONT face=Arial size=3></FONT> </DIV>
<DIV><FONT face=Arial size=3></FONT> </DIV>
<DIV><FONT face=Arial size=3>#
------------------------------------------------------------------------------</FONT></DIV>
<DIV><FONT face=Arial size=3>@@ -2371,6 +2372,16 @@</FONT></DIV>
<DIV><FONT face=Arial size=3>#
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</FONT></DIV>
<DIV><FONT face=Arial size=3>#
------------------------------------------------------------------------------</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=3>+tarpit() {</FONT></DIV>
<DIV><FONT face=Arial size=3>+ work_realcmd_secondary ${FUNCNAME}
"$@"</FONT></DIV>
<DIV><FONT face=Arial size=3>+ </FONT></DIV>
<DIV><FONT face=Arial size=3>+ require_work set any || return 1</FONT></DIV>
<DIV><FONT face=Arial size=3>+</FONT></DIV>
<DIV><FONT face=Arial size=3>+ set_work_function "Setting tarpit on interface
'${work_inface}' ${work_name}"</FONT></DIV>
<DIV><FONT face=Arial size=3>+ work_tarpit=1</FONT></DIV>
<DIV><FONT face=Arial size=3>+</FONT></DIV>
<DIV><FONT face=Arial size=3>+ return 0</FONT></DIV>
<DIV><FONT face=Arial size=3>+}</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=3>#
------------------------------------------------------------------------------</FONT></DIV>
<DIV><FONT face=Arial size=3># Change the policy of an interface</FONT></DIV>
<DIV><FONT face=Arial size=3>@@ -2792,6 +2803,7 @@</FONT></DIV>
<DIV><FONT face=Arial size=3>work_inface=</FONT></DIV>
<DIV><FONT face=Arial size=3>work_outface=</FONT></DIV>
<DIV><FONT face=Arial
size=3>work_policy="${DEFAULT_INTERFACE_POLICY}"</FONT></DIV>
<DIV><FONT face=Arial size=3>+ work_tarpit=0</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=3>return 0</FONT></DIV>
<DIV><FONT face=Arial size=3>}</FONT></DIV>
<DIV><FONT face=Arial size=3>@@ -2826,6 +2838,10 @@</FONT></DIV>
<DIV><FONT face=Arial size=3>rule chain "in_${work_name}" state RELATED action
ACCEPT || return 1</FONT></DIV>
<DIV><FONT face=Arial size=3>rule chain "out_${work_name}" state RELATED action
ACCEPT || return 1</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=3>+ if [ ${work_tarpit} -eq 1 ]; then</FONT></DIV>
<DIV><FONT face=Arial size=3>+ rule chain "in_${work_name}" "${inlog[@]}" proto
tcp action tarpit || return 1</FONT></DIV>
<DIV><FONT face=Arial size=3>+ fi</FONT></DIV>
<DIV><FONT face=Arial size=3>+</FONT></DIV>
<DIV><FONT face=Arial size=3>rule chain "in_${work_name}" "${inlog[@]}" action
${work_policy} || return 1</FONT></DIV>
<DIV><FONT face=Arial size=3>rule reverse chain "out_${work_name}"
"${outlog[@]}" action ${work_policy} || return 1</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=3>@@ -3575,6 +3591,10 @@</FONT></DIV>
<DIV><FONT face=Arial size=3>action="DROP"</FONT></DIV>
<DIV><FONT face=Arial size=3>;;</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=3>+ tarpit|TARPIT)</FONT></DIV>
<DIV><FONT face=Arial size=3>+ action="TARPIT"</FONT></DIV>
<DIV><FONT face=Arial size=3>+ ;;</FONT></DIV>
<DIV><FONT face=Arial size=3>+ </FONT></DIV>
<DIV><FONT face=Arial size=3>reject|REJECT)</FONT></DIV>
<DIV><FONT face=Arial size=3>action="REJECT"</FONT></DIV>
<DIV><FONT face=Arial size=3>if [ "${1}" = "with" ]</FONT></DIV>
<DIV><FONT face=Arial><FONT
size=3></FONT></SPAN></FONT></FONT> </DIV></BODY></HTML>