3 ms·
- SELinux Enabled - Sysctl tuning applied - Inbound/Outbound/Forward iptables rules enabled - ipset iptables rules enabled - iptables intercept rules to
by LinuxBender 9y ago
- SELinux Enabled
- Sysctl tuning applied
- Inbound/Outbound/Forward iptables rules enabled
- ipset iptables rules enabled
- iptables intercept rules to route all ntp/dns over VPN
to VPS nodes.
- Unbound DNS overriding many spammy domains
- tinc vpn enabled to multiple VPS nodes.
-- Each VPS node load balancing to multiple datacenter open resolvers that
are NOT OpenDNS or Google.
- ip route blackhole about 20k bad networks from firehol on github
- syslog to internal host
- Surricata IDS logging to syslog
- tc cbq traffic shaping enabled
- haproxy L4 vips for sending select traffic to select squid proxies.
- power conditionor / ups enabled, one for router, one for cable modem.
Those are the basic things. My router is always Linux running on commodity hardware with dual gig interfaces for clear physical demarcation.
- captaindiego 9y agoDoes anyone know anything for somehow providing useful information/action out of Surricata IDS logs? I have stuff routed to my syslog, but just always forgot to check for anything interesting.
- thinkMOAR 9y agoGot any suggestion to have ipset(s) persistent over reboots?
- fosco 9y agocan you share a guide on implementing this that you have used? including hardware and specific OS used?