anonfunc/xtables-addons
1
0
Fork 0
mirror of git://git.code.sf.net/p/xtables-addons/xtables-addons synced 2026-01-03 22:03:52 +01:00
Code Issues Releases Wiki Activity

doc: properly escape non-hyphens

Browse Source
This commit is contained in:
Jan Engelhardt
2009-10-03 21:41:29 +02:00
parent 0b64b27172
commit 0541154a5e
21 changed files with 115 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
extensions/libxt_TARPIT.man
View File

@@ -11,16 +11,16 @@ tarpit.
To tarpit connections to TCP port 80 destined for the current machine:
.IP
-A INPUT -p tcp -m tcp --dport 80 -j TARPIT
.P
\-A INPUT \-p tcp \-m tcp \-\-dport 80 \-j TARPIT
.PP
To significantly slow down Code Red/Nimda-style scans of unused address space,
forward unused ip addresses to a Linux box not acting as a router (e.g. "ip
route 10.0.0.0 255.0.0.0 ip.of.linux.box" on a Cisco), enable IP forwarding on
the Linux box, and add:
.IP
-A FORWARD -p tcp -j TARPIT
\-A FORWARD \-p tcp \-j TARPIT
.IP
-A FORWARD -j DROP
\-A FORWARD \-j DROP
.PP
NOTE:
If you use the conntrack module while you are using TARPIT, you should also use
@@ -28,6 +28,6 @@ the NOTRACK target, or the kernel will unnecessarily allocate resources for
each TARPITted connection. To TARPIT incoming connections to the standard IRC
port while using conntrack, you could:
.IP
-t raw -A PREROUTING -p tcp --dport 6667 -j NOTRACK
\-t raw \-A PREROUTING \-p tcp \-\-dport 6667 \-j NOTRACK
.IP
-A INPUT -p tcp --dport 6667 -j TARPIT
\-A INPUT \-p tcp \-\-dport 6667 \-j TARPIT