Blocking spoofed addresses
IP spoofing is a very common technique used by attackers to send malicious packets to a computer server. This is the process of creating IP packets with a forged IP address. It is mainly used for attacks such as Denial of Service (DoS).
Getting Ready
If we wish to block a spoofed IP address, we need to have a list of IP addresses or domain names from where these spoofed connections have been trying to connect.
How to do it...
We will try to create a basic ruleset of iptables through which we will restrict all incoming packets, except those that are necessary for our usage:
- The first step is to create a rule to allow access to the loopback interface so that services on the system can communicate properly with each other locally. ...
Get Practical Linux Security Cookbook now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
