{"id":448,"date":"2010-11-10T09:21:43","date_gmt":"2010-11-10T17:21:43","guid":{"rendered":"http:\/\/www.outflux.net\/blog\/?p=448"},"modified":"2010-11-10T09:21:43","modified_gmt":"2010-11-10T17:21:43","slug":"tarpit-iptables-target","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2010\/11\/10\/tarpit-iptables-target\/","title":{"rendered":"TARPIT iptables target"},"content":{"rendered":"<p>Want to use a <a href=\"http:\/\/en.wikipedia.org\/wiki\/Tarpit_%28networking%29\">network tarpit<\/a>?  It&#8217;s so easy to set up! Thanks to jpds for this whole post. :)<\/p>\n<pre class=\"brush:shell\">\r\nsudo module-assistant auto-install xtables-addons-source\r\nsudo iptables -p tcp ... -j TARPIT\r\n<\/pre>\n<p>Though no such thing exists for IPv6 yet.<\/p>\n<p>Here it is watching over the SSH port:<\/p>\n<pre class=\"brush:shell\">\r\niptables -N INGRESS-SSH\r\niptables -A INPUT -p tcp --dport 22 -m state --state NEW -j INGRESS-SSH\r\niptables -A INGRESS-SSH -p tcp --dport 22 -m state --state NEW -m recent --name SSH --set\r\niptables -A INGRESS-SSH -p tcp --dport 22 -m state --state NEW -m recent --name SSH --update --rttl --seconds 60 --hitcount 4 -j LOG --log-prefix \"[INGRESS SSH TARPIT] \"\r\niptables -A INGRESS-SSH -p tcp --dport 22 -m state --state NEW -m recent --name SSH --rcheck --rttl --seconds 60 --hitcount 4 -j TARPIT\r\n<\/pre>\n<p style='text-align:left'>&copy; 2010, <a href=\"https:\/\/outflux.net\/blog\/\">Kees Cook<\/a>. This work is licensed under a <a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\">Creative Commons Attribution-ShareAlike 4.0 License<\/a>.<br \/><a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\"><img decoding=\"async\" alt=\"CC BY-SA 4.0\" style=\"border-width:0\" src=\"https:\/\/i.creativecommons.org\/l\/by-sa\/4.0\/88x31.png\" \/><\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Want to use a network tarpit? It&#8217;s so easy to set up! Thanks to jpds for this whole post. :) sudo module-assistant auto-install xtables-addons-source sudo iptables -p tcp &#8230; -j TARPIT Though no such thing exists for IPv6 yet. Here it is watching over the SSH port: iptables -N INGRESS-SSH iptables -A INPUT -p tcp [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,18,7,6,14,19],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/448"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=448"}],"version-history":[{"count":3,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/448\/revisions"}],"predecessor-version":[{"id":451,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/448\/revisions\/451"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=448"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=448"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=448"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}