FreeBSD Security Question

[freddy333]

This is for those who're FreeBSD Unix system admins:
Is there a way to drop/disconnected an IP addresss on-the-fly?

 

I've got an old server running FreeBSD 4.11, which, for a variety of reasons, cannot be upgraded to current kernel (long story). So, we're stuck dealing with it as-is. The server's been running without incident for ~18 years and has never suffered a breach or internal security issue. Trouble-makers are routinely added to our ipf firewall's deny list, which does a good job of keeping them away. However, this one (46.229.168... Advanced Hosters of Netherlands), although blocked at the firewall, is constantly banging on the site (currently pinging 40+ ports with variations of the core IP (e.g., 46.229.168.74, 46.229.168.72, 46.229.168.68, et al) and they're beginning to bog-down our connection.

 

Another server's running BSD 6.x, with tcpdrop, which makes dropping offending IPs like AH easy. But, unfortunately, the BSD 4.11 doesn't include tcpdrop, so I'm looking to find an alternative way of dropping IP connections.

 

Anyone?

[cpd2186]

Way above my pay grade......

Sent from my XT1254 using Tapatalk

[Beau7816]

This is for those who're FreeBSD Unix system admins:
Is there a way to drop/disconnected an IP addresss on-the-fly?
 
I've got an old server running FreeBSD 4.11, which, for a variety of reasons, cannot be upgraded to current kernel (long story). So, we're stuck dealing with it as-is. The server's been running without incident for ~18 years and has never suffered a breach or internal security issue. Trouble-makers are routinely added to our ipf firewall's deny list, which does a good job of keeping them away. However, this one (46.229.168... Advanced Hosters of Netherlands), although blocked at the firewall, is constantly banging on the site (currently pinging 40+ ports with variations of the core IP (e.g., 46.229.168.74, 46.229.168.72, 46.229.168.68, et al) and they're beginning to bog-down our connection.
 
Another server's running BSD 6.x, with tcpdrop, which makes dropping offending IPs like AH easy. But, unfortunately, the BSD 4.11 doesn't include tcpdrop, so I'm looking to find an alternative way of dropping IP connections.
 
Anyone?

I know a guy in NASA that talks like you ??

Sent from my SM-G935F using Tapatalk

[freddy333]

1 hour ago, Beau7816 said:

I know a guy in NASA that talks like you ??

Sent from my SM-G935F using Tapatalk
 

And the purpose of your posts was what?

[rails]

Could you call your ISP and get a new static IP for the box?


Sent from my iPhone using Tapatalk

I assume you've tried MAC address filtering at the router/firewall?


Sent from my iPhone using Tapatalk

[Beau7816]

I would have thought this is the wrong site for this conversation as I would not go to a mechanic and talk about antiques.

Sent from my SM-G935F using Tapatalk

[freddy333]

2 hours ago, rails said:

Could you call your ISP and get a new static IP for the box?

 

Changing the IP would muck up our domain name translation, and I was finally able to blackhole the miscreant, thus eliminating the problem.

Thank you.