<div dir="ltr">Do you have an iptables rule ahead of that drop rule allowing SSH inbound?</div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, May 13, 2015 at 7:28 AM, Steve VanSlyck <span dir="ltr"><<a href="mailto:s.vanslyck@postpro.net" target="_blank">s.vanslyck@postpro.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><u></u>
<div><div>Hi.<br></div>
<div> </div>
<div>I have this rule set it IPTABLES:<br></div>
<div> </div>
<div>Chain INPUT (policy DROP 1 packets, 44 bytes)<br></div>
<div> pkts bytes target prot opt in out source destination<br></div>
<div> </div>
<div> 4 212 DROP all -- * * <a href="http://213.0.0.0/8" target="_blank">213.0.0.0/8</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a><br></div>
<div> </div>
<div>However I still see attacks from 213.30.22.232 with username attempts in the log. It seems iptables is not dropping the connection if it gets to the point where submitting a user login name is allowed.<br></div>
<div> </div>
<div>Comments?</div>
<div> </div>
</div>
<br>_______________________________________________<br>
colug-432 mailing list<br>
<a href="mailto:colug-432@colug.net">colug-432@colug.net</a><br>
<a href="http://lists.colug.net/mailman/listinfo/colug-432" target="_blank">http://lists.colug.net/mailman/listinfo/colug-432</a><br>
<br></blockquote></div><br></div>