5 ms·
Nope nope nope. This has serious quality issues and any competent and nice sysadmin should say _nope_ to run this in any serious environment, for your own good
by joana035 6y ago
Nope nope nope.
This has serious quality issues and any competent and nice sysadmin should say _nope_ to run this in any serious environment, for your own good ;-)
IP addresses are just strings? At least parse/validate for IPv4/IPv6.
Why yet another database? Can't the rules be loaded from the running system?
Why not just ipset-persistent + knockd + portsentry? I know it is easy to get overexcited with a new pet project, but just be careful to not put this kind of stuff in a production system kidos.
- prashantgupta24 6y agoThank you for the feedback!
- joana035 6y agoAnytime. I saw you are already implementing some ideas from my inputs, that is great, please keep it going. Eventually, in notorious systems, you may face issues of having too many /32 rules, a good idea is to implement some mechanism to defragment them into single/bigger contiguous cidr blocks. There are other firewall implementations that can serve as inspiration. OR I recommend using ipset with a single iptables rule to match/block from the set. This way you don't need to reload stuff everytime. (Just add the ips into the set) PS: I hope you don't mind my snark comments, HN is fun.
- prashantgupta24 6y agoI do not mind at all. I appreciate constructive criticism. Plus you gave me points to work on, I really appreciate that. So much to learn!