<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2600.0" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>
<DIV><FONT face=Arial size=2>
<DIV><FONT face=Arial size=2>Wanadoo.fr - VERY VERY Bad people - I just thought
I'd share and ask for comments on what I'm doing here - </FONT><FONT face=Arial
size=2>I have had NIGHTMARES from wanadoo.fr FTP entry attempts - I have a
firewall infront of my servers - but on the servers themselves I am running
t</FONT><FONT face=Arial size=2>his little shell script:</FONT></DIV>
<DIV><FONT face=AGaramond><PRE>#!/bin/sh
IPT="/sbin/iptables"
#Time to clean house
#Clear out any existing firewall rules, and any chains that might have
#been created
$IPT -F
$IPT -F INPUT
$IPT -F OUTPUT
$IPT -F FORWARD
$IPT -F -t mangle
$IPT -F -t nat
$IPT -X
#Kill the bad people
$IPT -A INPUT -s 12.251.175.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 193.251.4.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 193.253.194.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 193.253.219.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 193.253.225.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 193.253.52.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 193.253.52.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 195.174.97.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 203.141.145.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 208.251.123.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 211.47.146.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 212.60.36.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 213.132.154.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 216.51.102.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 217.136.15.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 217.136.4.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 217.226.53.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 217.230.227.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 62.155.143.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 62.163.200.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 65.93.161.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 80.11.22.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 80.11.22.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 80.13.160.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 80.13.210.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 80.8.80.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 80.11.81.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 216.112.42.58 -d 0/0 -j DROP
$IPT -A INPUT -s 208.18.255.7 -d 0/0 -j DROP
$IPT -A INPUT -s wanadoo.fr -d 0/0 -j DROP
$IPT -A INPUT -s lan.ch -d 0/0 -j DROP
$IPT -A INPUT -s eastdil.com -d 0/0 -j DROP
$IPT -A INPUT -s sympatico.ca -d 0/0 -j DROP
$IPT -A INPUT -s krline.net -d 0/0 -j DROP
$IPT -A INPUT -s noos.fr -d 0/0 -j DROP
$IPT -A INPUT -s 213.123.135.117 -d 0/0 -j DROP
$IPT -A INPUT -s 213.123.135.117 -d 0/0 -j DROP
$IPT -A INPUT -s 212.198.120.55 -d 0/0 -j DROP
$IPT -A INPUT -s 212.195.10.139 -d 0/0 -j DROP
$IPT -A INPUT -s 217.136.35.57 -d 0/0 -j DROP
$IPT -A INPUT -s 217.230.226.126 -d 0/0 -j DROP
$IPT -A INPUT -s 213.96.11.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 217.128.56.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 217.136.32.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 217.83.96.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 80.11.97.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 212.98.68.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 217.230.189.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 80.135.16.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 62.108.11.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 217.128.35.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 217.128.27.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 217.128.73.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 212.83.85.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 217.225.197.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 64.217.144.145 -d 0/0 -j DROP
$IPT -A INPUT -s 65.67.100.126 -d 0/0 -j DROP
$IPT -A INPUT -s 217.128.243.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 80.13.155.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 80.13.155.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 145.254.63.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 217.1.113.0/24 -d 0/0 -j DROP
$IPT -A INPUT -s 80.11.100.0/24 -d 0/0 -j DROP
</PRE></FONT></DIV>
<DIV><FONT face=AGaramond>Then in </FONT><FONT face=Arial
size=2>/etc/hosts.deny</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV>#The following section contains mostly FTP problem makers <BR>ALL:
.wanadoo.fr,\
<BR> .retevision.es,\
<BR> .wiwiss.fu-berlin.de,\
<BR> .ewetel.net,\
<BR> 172.188.82.22,\
<BR> .nombres.ttd.es,\
<BR> 131.204.203.45,\
<BR> 134.184.28.169,\
<BR> .estpak.ee,\
<BR> .kuban.ru,\
<BR> .tin.it,\
<BR> .cybercable.tm.fr,\
<BR> .pixelhouse.de,\
<BR> 212.199.28.108,\
<BR> 62.98.228.73,\
<BR> 213.237.24.20,\
<BR> 213.97.98.62,\
<BR> 213.82.103.67,\
<BR> 212.199.187.214,\
<BR> .nykredit.dk,\
<BR> 195.101.176.125,\
<BR> 195.70.202.,\
<BR> 192.118.6.32,\
<BR> ip87-226.adsl.wplus.ru,\
<BR> .o-tel-o.net,\
<BR> .dip.t-dialin.net,\
<BR> .evc.net,\
<BR> 213.96.224.5,\
<BR> .home.com,\
<BR> .phoenix-t.navipath.net,\
<BR> .nyc.cccnetsys.com,\
<BR> .bezeqint.net,\
<BR> .chello.nl,\
<BR> .chello.fr,\
<BR> .cccnetsys.com,\
<BR> .quicknet.nl,\
<BR> .nordnet.fr,\
<BR> 217.81.85.58,\
<BR> 217.225.12.3,\
<BR> .linix.co.uk,\
<BR> .hombres.ttd.es,\
<BR> 24.25.251.149,\
<BR> 24.226.198.25,\
<BR> 24.252.140.221,\
<BR> .sympatico.ca,\
<BR> .isis.de,\
<BR> .net.mx,\
<BR> .brutele.be,\
<BR> .skynet.be,\
<BR> .club-internet.fr,\
<BR> .reimari.net,\
<BR> .stuwo-steinweg.de,\
<BR> .superonlinecorporate.com,\
<BR> .adsl.hansenet.de,\
<BR> .worldonline.dk,\
<BR> .ipt.aol.com,\
<BR> .net24.it</DIV></FONT></DIV></FONT></DIV>
<DIV><BR><BR>
<TABLE width="100%">
<TBODY>
<TR>
<TD align=left>Thanks,<BR><BR><BR>Daniel<BR>Webmaster for:<BR><A
href="http://www.srj.net">http://www.srj.net</A><BR><A
href="http://www.hometownhospital.com">http://www.hometownhospital.com</A><BR><A
href="http://www.easyhealthcare.net">http://www.easyhealthcare.net</A><BR><A
href="http://www.ngpa.org">http://www.ngpa.org</A><BR><A
href="http://www.cathedralofhope.com">http://www.cathedralofhope.com</A><BR><A
href="http://www.iusarentals.com">http://www.iusarentals.com</A><BR><BR><!-- BEGIN HumanClick Button Code -->
<TABLE cellSpacing=0 cellPadding=0 border=0>
<TBODY>
<TR>
<TD align=middle><A
onclick="window.open('http://hc2.humanclick.com/hc/20922718/?cmd=file&file=visitorWantsToChat&site=20922718','chat20922718','width=472,height=320');return false;"
href="http://hc2.humanclick.com/hc/20922718/?cmd=file&file=visitorWantsToChat&site=20922718&byhref=1"
target=chat20922718><IMG height=37
src="http://hc2.humanclick.com/hc/20922718/?cmd=repstate&site=20922718&imageUrl=http://www.srj.net/humanclick&ver=1"
width=152 border=0 name=hcIcon></A></TD></TR></TBODY></TABLE><BR>
<TABLE width="100%">
<TBODY>
<TR>
<TD align=left></TD></TR></TBODY></TABLE><BR>*** CONFIDENTIALITY NOTICE
*** Privileged/Confidential Information may be contained in this message
and/or its attachments. This message and its attachments are intended only
for use by the individual(s) listed as the recipient(s). If you are not
one of the intended recipient(s), or responsible for delivery of the
message to such person, you are hereby notified that any disclosure,
copying, distribution, or the taking of any action in reliance on the
contents of this information is strictly prohibited. If you have received
this message in error, please notify the sender by return email and
destroy all copies of the email. Opinions, conclusions and other
information in this message that do not relate to official company
business shall be understood as neither given nor endorsed by the company.
</TR></TBODY></DIV></BODY></HTML>