2
Wow, I know a lot of Linux, and there's still a lot more to learn…
I had to edit the netplan config file (the program that replaces ifupdown in Ubuntu) and remove the gateway from my new NIC. I thought it needed one just out of habbit, but since it has no Internet access, it doesn't need a gateway.
That meant in the shell…
nano /etc/netplan/01-netcfg.yaml
...
1
I'm not suggesting this is the best option, but if you can't find another that works then you could "roll your own" using a downloadable GeoIP database and the ipset tool.
For example download the Geolite2 database Countries in CSV format. Download and unzip the files:
wget https://geolite.maxmind.com/download/geoip/database/GeoLite2-Country-CSV.zip
unzip ...
1
A total of 2500 rules would be a big effort for the CPU/bandwidth in case of affecting each package. If, for example, you send 10000 packages you would be analyzing 25.000.000 rules, that would suppose a lot of work. It would be a lot of more accurate and secure to block all the incoming traffic (except the established and the related), and then start ...
1
What xx-tables is the best to filter (limit, not drop) ARP packets?
iptables
iptables starts from IP layer: it's already too late to handle ARP.
arptables
While specialized in ARP, arptables lacks the necessary matches and/or targets to limit rather than just drop ARP packets. It can't be used for your purpose.
ebtables
ebtables can be a candidate (it ...
1
1) From fwknop documentation:
The fwknop project supports four different firewalls: iptables,
firewalld, PF, and ipfw across Linux, OpenBSD, FreeBSD, and Mac OS X.
There is also support for custom scripts so that fwknop can be made to
support other infrastructure such as ipset or nftables.
So clearly, it officially supports 4 firewalls only. But ...
Only top voted, non community-wiki answers of a minimum length are eligible
