# $Header: /global/src/etc/cl-manage-scripts/patches/RCS/P-iptables-ssh-in-vlan100,v 1.2 2010/10/21 05:32:49 pb22 Exp $
# patch to further restrict ssh access to be from VLAN 100
# patch-file matches : ssh.from.within.the.Lab.on.VLAN.100
# patch-file distmatches = Fedora.Core.release.[56]|Fedora.release.[78]|CentOS|Red.Hat.Enterprise.Linux
# Process using /usr/bin/cl-patch-file unless matching the above
--- /etc/sysconfig/iptables	2008-05-02 07:59:21.000000000 +0100
+++ /etc/sysconfig/iptables	2008-10-30 06:49:15.000000000 +0000
@@ -21,6 +21,6 @@
-#5 Allow ssh from within the Lab, but block repeated calls from outside (i.e. 3 / 80s)
--A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s 128.232.0.0/17 --dport 22 -j ACCEPT
--A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m recent --rcheck --seconds 80 --hitcount 3 --name SSH --rsource -j LOG -m limit --limit 10/sec --log-prefix "ipt: recent SSH DROP "
--A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m recent --update --seconds 80 --hitcount 3 --name SSH --rsource -j DROP
--A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m recent --rcheck --seconds 80 --hitcount 1 --name SSH --rsource -j LOG -m limit --limit 10/sec --log-prefix "ipt: recent SSH count "
--A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m recent --set --name SSH --rsource -j ACCEPT
+#5 Allow ssh from within the Lab on VLAN 100 only, as hardened machine.
+-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s 128.232.0.0/20 --dport 22 -j ACCEPT
+#A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m recent --rcheck --seconds 80 --hitcount 3 --name SSH --rsource -j LOG -m limit --limit 10/sec --log-prefix "ipt: recent SSH DROP "
+#A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m recent --update --seconds 80 --hitcount 3 --name SSH --rsource -j DROP
+#A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m recent --rcheck --seconds 80 --hitcount 1 --name SSH --rsource -j LOG -m limit --limit 10/sec --log-prefix "ipt: recent SSH count "
+#A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m recent --set --name SSH --rsource -j ACCEPT
