netstat -alpn | grep :80 | awk '{print $5}' |awk -F: '{print $(NF-1)}' |sort | uniq -c | sort -n
Blokuojami IP adresai saugomi ugniasienės faile /etc/hosts.deny tačiau geriausia įvesti blokuoamus IP per CMD:
# iptables -A INPUT -s 65.55.44.100 -j DROP
# service iptables save
Blokavimui atšaukti:
# iptables -D INPUT -s 65.55.44.100 -j DROP
# service iptables save
Pažiūrėjimui kas blokuojama:
iptables -L -n
Pastaba: kai kurie VDS limituoja iptables irasu limita iki 4000 ir to negalima padidinti ant openVZ platformos, taip pat siojeplatformoje nebeikia ipset listai.
iptables-save to dump the current rule set into a file.iptables-save > /etc/sysconfig/iptables
To load the file you don't need to restart the machine, you can use
iptables-restoreiptables-restore < /etc/sysconfig/iptablesiptables -A INPUT -p tcp -m tcp --dport 22 -m comment --comment "allow SSH to this host from anywhere" -j ACCEPT
Ne visi VDS palaiko rules comment: Depending on your distribution, you may need to load the ipt_comment or xt_comment modules into your running kernel first.
Norint uzblokuoti mysql is isopres:
iptables -A INPUT -p tcp --dport 3306 -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP
If you want to remove the filtering, use this:
iptables -D INPUT -p tcp --dport 3306 -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
iptables -D INPUT -p tcp --dport 3306 -j DROP
ARBA, be iptables galima pasieiti: Add to my.cnf:
skip-networking
Please note you will need to use localhost, not 127.0.0.1, after the change.
