{"id":38982,"date":"2019-10-31T22:27:11","date_gmt":"2019-10-31T19:27:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih\/"},"modified":"2019-10-31T22:27:11","modified_gmt":"2019-10-31T19:27:11","slug":"iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih","title":{"rendered":"Iptables a filtrov\u00e1n\u00ed provozu proti chud\u00fdm a leniv\u00fdm jinak sm\u00fd\u0161lej\u00edc\u00edm","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Relevance of blocking access to prohibited resources concerns any admin who may officially face accusations of non-compliance with the law or orders from relevant authorities. <\/p>\n<p><img decoding=\"async\" alt=\"Iptables a filtrov\u00e1n\u00ed provozu proti chud\u00fdm a leniv\u00fdm jinak sm\u00fd\u0161lej\u00edc\u00edm\" src=\"\/wp-content\/uploads\/2019\/10\/add48d25f687f411cd3c9235c9df61c1.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nWhy reinvent the wheel when there are specialized programs and distributions for our tasks, such as: Zeroshell, pfSense, ClearOS. <\/p>\n<p>Another question arose from management: Is the used product certified for security by our state?<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nWe have experience with the listed distributions:<\/p>\n<ul>\n<li>Zeroshell \u2014 the developers even gifted us a 2-year license, but it turned out that the distribution of interest was illogical for us in performing a critical function;<\/li>\n<li>pfSense \u2014 respect and honor, but also boredom; getting used to the FreeBSD firewall command line was not convenient for us (I think it\u2019s a matter of habit, but it didn\u2019t turn out to be 'the right way');<\/li>\n<li>ClearOS \u2014 turned out to be very slow on our hardware; we couldn\u2019t reach serious testing, so why such heavy interfaces? <\/li>\n<li>Ideco SELECTA. The product 'Aideco' is a separate conversation; it\u2019s an interesting product but politically not for us. I also want to 'bite' them regarding the license for the same Linux, Roundcube, etc. How did they come to think that by 'cutting' the interface and taking superuser rights they can sell a finished product composed of developed and refined modules from the internet community distributed under GPL&amp;etc. <b>CouchDB<\/b> I understand that negative remarks demanding a detailed justification of my subjective feelings will now fall upon me, but I want to say that this network node also serves as a traffic balancer for 4 external channels to the Internet, and each channel has its own features. Another cornerstone became the necessity for one of several network interfaces to operate in different address spaces, and I<\/li>\n<\/ul>\n<p>\nam ready <b>to admit that I am not ready to apply VLANs everywhere they are needed and not needed.<\/b> In terms of devices like TP-Link TL-R480T+ \u2014 they do not behave perfectly, with their own nuances. This part was reasonably configured on Linux thanks to the official Ubuntu website. <b>IP Load Balancing: combining multiple internet channels into one.<\/b>. V u\u017e\u00edv\u00e1n\u00ed jsou za\u0159\u00edzen\u00ed typu TP-Link TL-R480T+ \u2014 chovaj\u00ed se neide\u00e1ln\u011b, obecn\u011b s n\u011bkter\u00fdmi nuancemi. Tuto \u010d\u00e1st se poda\u0159ilo rozumn\u011b nastavit na Linuxu d\u00edky ofici\u00e1ln\u00edmu webu Ubuntu. <noindex><a rel=\"nofollow\" href=\"https:\/\/help.ubuntu.ru\/wiki\/ip_balancing\">IP-Balancing: spojujeme n\u011bkolik internetov\u00fdch kan\u00e1l\u016f do jednoho.<\/a><\/noindex>. Ka\u017ed\u00fd z kan\u00e1l\u016f m\u016f\u017ee kdykoliv \u201espadnout\u201c i vzr\u016fst. Pokud v\u00e1s zaj\u00edm\u00e1 skript, kter\u00fd aktu\u00e1ln\u011b funguje (o tom by se m\u011bla napsat zvl\u00e1\u0161tn\u00ed publikace) \u2014 pi\u0161te do koment\u00e1\u0159\u016f. <\/p>\n<p>Zva\u017eovan\u00e9 \u0159e\u0161en\u00ed si nen\u00e1rokuje na unik\u00e1tnost, ale cht\u011bl bych se zeptat: \u201ePro\u010d by se m\u011blo v podniku p\u0159izp\u016fsobovat pochybn\u011b funk\u010dn\u00edm produkt\u016fm se zna\u010dn\u00fdmi hardwarov\u00fdmi po\u017eadavky, kdy\u017e lze zv\u00e1\u017eit alternativn\u00ed variantu?\u201c.<\/p>\n<p>Pokud existuje v RF seznam Roskomnadzoru, na Ukrajin\u011b \u2014 p\u0159\u00edloha k rozhodnut\u00ed Rady n\u00e1rodn\u00ed bezpe\u010dnosti (nap\u0159. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.president.gov.ua\/documents\/1262018-24150\">tady je<\/a><\/noindex>), tam na m\u00edstech tak\u00e9 vedouc\u00ed nezah\u00e1l\u00ed. Nap\u0159\u00edklad n\u00e1m byl p\u0159ed\u00e1n seznam zak\u00e1zan\u00fdch str\u00e1nek, kter\u00e9 podle veden\u00ed zhor\u0161uj\u00ed produktivitu pr\u00e1ce na pracovi\u0161ti. <\/p>\n<p>Kdy\u017e jsme komunikovali s kolegy v jin\u00fdch podnic\u00edch, kde jsou ve v\u00fdchoz\u00edm nastaven\u00ed zak\u00e1z\u00e1ny v\u0161echny str\u00e1nky a pouze na \u017e\u00e1dost s povolen\u00edm vedouc\u00edho je mo\u017en\u00e9 z\u00edskat p\u0159\u00edstup k konkr\u00e9tn\u00ed str\u00e1nce, s \u00factou se usm\u00edvaj\u00edc, jsme p\u0159em\u00fd\u0161leli a \u201ep\u0159em\u00edtali nad probl\u00e9mem\u201c, p\u0159i\u0161li jsme na to, \u017ee \u017eivot je p\u0159ece jen dobr\u00fd a za\u010dali jsme sv\u016fj vlastn\u00ed hled\u00e1n\u00ed.<\/p>\n<p>M\u011bli jsme mo\u017enost nejen analyticky se pod\u00edvat na to, co se p\u00ed\u0161e v \u201eknih\u00e1ch hospodyn\u011bk\u201c o filtrov\u00e1n\u00ed trafficu, ale tak\u00e9 vid\u011bt, co se d\u011bje na kan\u00e1lech r\u016fzn\u00fdch poskytovatel\u016f. Zaznamenali jsme n\u00e1sleduj\u00edc\u00ed recepty (jak\u00e9koli sn\u00edmky obrazovky jsou m\u00edrn\u011b o\u0159\u00edznut\u00e9, pros\u00edm pochopte, \u017ee je \u017e\u00e1d\u00e1m):<\/p>\n<p>Poskytovatel 1<br \/>\n \u2014 se t\u00edm nezam\u011b\u0159uje a nut\u00ed sv\u00e9 vlastn\u00ed DNS servery a pr\u016fhledn\u00fd proxy server. Nu co\u017e?.. ale m\u00e1me p\u0159\u00edstup tam, kam pot\u0159ebujeme (pokud to pot\u0159ebujeme :))<\/p>\n<p>Poskytovatel 2<br \/>\n \u2014 domn\u00edv\u00e1 se, \u017ee jeho vy\u0161\u0161\u00ed poskytovatel by o tom m\u011bl uva\u017eovat, technick\u00e1 podpora vy\u0161\u0161\u00edho poskytovatele se dokonce p\u0159iznala, pro\u010d nemohu otev\u0159\u00edt pot\u0159ebnou nezak\u00e1zanou str\u00e1nku. Mysl\u00edm, \u017ee v\u00e1s obr\u00e1zek pobav\u00ed \ud83d\ude42<\/p>\n<p><img decoding=\"async\" alt=\"Iptables a filtrov\u00e1n\u00ed provozu proti chud\u00fdm a leniv\u00fdm jinak sm\u00fd\u0161lej\u00edc\u00edm\" src=\"\/wp-content\/uploads\/2019\/10\/ea50d22bb4ab91bfdd52ceae9ccde0e2.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJak se uk\u00e1zalo, p\u0159ev\u00e1d\u011bj\u00ed zak\u00e1zan\u00e9 str\u00e1nky na IP adresy a blokuj\u00ed p\u0159\u00edmo IP (nevad\u00ed jim, \u017ee na t\u00e9to IP adrese m\u016f\u017ee b\u00fdt um\u00edst\u011bno tak\u00e9 20 str\u00e1nek). <\/p>\n<p>Poskytovatel 3<br \/>\n \u2014 propou\u0161t\u00ed traffic tam, ale zp\u011bt po trase ho nepou\u0161t\u00ed.<\/p>\n<p>Poskytovatel 4<br \/>\n \u2014 zakazuje v\u0161echny manipulace s pakety v uveden\u00e9m sm\u011bru.<\/p>\n<p>A co d\u011blat s VPN (prohl\u00ed\u017ee\u010d Opera je respektov\u00e1n) a pluginy pro prohl\u00ed\u017ee\u010de? Kdy\u017e jsme si hr\u00e1li s uzlov\u00fdm Mikrotik, dokonce jsme p\u0159i\u0161li s v\u00fdpo\u010detn\u011b n\u00e1ro\u010dn\u00fdm receptem na L7, od kter\u00e9ho jsme nakonec museli odstoupit (zak\u00e1zan\u00fdch n\u00e1zv\u016f m\u016f\u017ee b\u00fdt mnohem v\u00edc, je smutn\u00e9, kdy\u017e krom\u011b sv\u00fdch p\u0159\u00edm\u00fdch povinnost\u00ed k trasov\u00e1n\u00ed, na 30 vyj\u00e1d\u0159en\u00edch zat\u00ed\u017een\u00ed procesoru PPC460GT dosahuje 100%).<\/p>\n<p><img decoding=\"async\" alt=\"Iptables a filtrov\u00e1n\u00ed provozu proti chud\u00fdm a leniv\u00fdm jinak sm\u00fd\u0161lej\u00edc\u00edm\" src=\"\/wp-content\/uploads\/2019\/10\/c71db959ded51da02ad43e8e14a4144b.jpg\" style=\"display:block;margin: 0 auto;\" \/>.<\/p>\n<p>Co se uk\u00e1zalo jako jasn\u00e9:<br \/>\nDNS na 127.0.0.1 rozhodn\u011b nen\u00ed panacea, modern\u00ed verze prohl\u00ed\u017ee\u010d\u016f skute\u010dn\u011b umo\u017e\u0148uj\u00ed obch\u00e1zet podobn\u00e9 probl\u00e9my. Nelze omezit v\u0161echny u\u017eivatele z\u00fa\u017een\u00fdmi pr\u00e1vy a nelze zapom\u00ednat na ohromn\u00e9 mno\u017estv\u00ed alternativn\u00edch DNS. Internet nen\u00ed statick\u00fd, a krom\u011b nov\u00fdch adres DNS zak\u00e1zan\u00e9 weby kupuj\u00ed nov\u00e9 adresy, m\u011bn\u00ed dom\u00e9ny nejvy\u0161\u0161\u00ed \u00farovn\u011b, mohou p\u0159idat\/odstranit znak ve sv\u00e9 adrese. Ale p\u0159esto m\u00e1 pr\u00e1vo na existenci n\u011bco jako:<\/p>\n<pre><code class=\"bash\">ip route add blackhole 1.2.3.4<\/code><\/pre>\n<p>\nCelkem \u00fa\u010dinn\u00e9 by bylo z\u00edsk\u00e1n\u00ed seznamu IP adres ze seznamu zak\u00e1zan\u00fdch web\u016f, ale z v\u00fd\u0161e uveden\u00fdch d\u016fvod\u016f jsme p\u0159e\u0161li k \u0159e\u0161en\u00edm pomoc\u00ed Iptables. Ji\u017e existoval funk\u010dn\u00ed vyva\u017eova\u010d zat\u00ed\u017een\u00ed na CentOS Linux release 7.5.1804.<\/p>\n<p>Internet u u\u017eivatele by m\u011bl b\u00fdt rychl\u00fd a prohl\u00ed\u017ee\u010d by nem\u011bl \u010dekat p\u016fl minuty, aby zjistil, \u017ee tato str\u00e1nka nen\u00ed dostupn\u00e1. Po dlouh\u00e9m hled\u00e1n\u00ed jsme se dostali k n\u00e1sleduj\u00edc\u00edmu modelu:<br \/>\nSoubor 1 -&gt; <b>\/script\/denied_host<\/b>, seznam zak\u00e1zan\u00fdch n\u00e1zv\u016f:<\/p>\n<pre><code class=\"plaintext\">test.test\nblablabla.bubu\ntorrent\nporno<\/code><\/pre>\n<p>\nSoubor 2 -&gt; <b>\/script\/denied_range<\/b>, seznam zak\u00e1zan\u00fdch adresn\u00edch prostor\u016f a adres:<\/p>\n<pre><code class=\"plaintext\">192.168.111.0\/24\n241.242.0.0\/16<\/code><\/pre>\n<p>\nSoubor-skript 3 -&gt; <b>ipt.sh<\/b>, kter\u00fd prov\u00e1d\u00ed pr\u00e1ci s iptables:<\/p>\n<pre><code class=\"bash\"># \u0441\u0447\u0438\u0442\u044b\u0432\u0430\u0435\u043c \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438\u0437 \u043f\u0435\u0440\u0435\u0447\u043d\u0435\u0439 \u0444\u0430\u0439\u043b\u043e\u0432\nHOSTS=`cat \/script\/denied_host | grep -v '^#'`\nRANGE=`cat \/script\/denied_range | grep -v '^#'`\necho \"Stopping firewall and allowing everyone...\"\n# \u0441\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u0435\u043c \u0432\u0441\u0435 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 iptables, \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u044f \u0442\u043e \u0447\u0442\u043e \u043d\u0435 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043e\nsudo iptables -F\nsudo iptables -X\nsudo iptables -t nat -F\nsudo iptables -t nat -X\nsudo iptables -t mangle -F\nsudo iptables -t mangle -X\nsudo iptables -P INPUT ACCEPT\nsudo iptables -P FORWARD ACCEPT\nsudo iptables -P OUTPUT ACCEPT\n#\u0440\u0435\u0448\u0430\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430\u0445 (\u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u043d\u0430\u0448\u0435\u0439 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b)\nsudo sh rout.sh\n# \u0446\u0438\u043a\u043b\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044f \u043a\u0430\u0436\u0434\u0443\u044e \u0441\u0442\u0440\u043e\u043a\u0443 \u0444\u0430\u0439\u043b\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0441\u0442\u0440\u043e\u043a\u0438\nfor i in $HOSTS; do\nsudo iptables -I FORWARD -m string --string $i --algo bm --from 1 --to 600 -p tcp -j REJECT --reject-with tcp-reset;\nsudo iptables -I FORWARD -m string --string $i --algo bm --from 1 --to 600 -p udp -j DROP;\ndone\n# \u0446\u0438\u043a\u043b\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044f \u043a\u0430\u0436\u0434\u0443\u044e \u0441\u0442\u0440\u043e\u043a\u0443 \u0444\u0430\u0439\u043b\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0430\u0434\u0440\u0435\u0441\u0430\nfor i in $RANGE; do\nsudo iptables -I FORWARD -p UDP -d $i -j DROP;\nsudo iptables -I FORWARD -p TCP  -d $i -j REJECT --reject-with tcp-reset;\ndone\n<\/code><\/pre>\n<p>\nPou\u017eit\u00ed sudo je d\u016fsledkem skute\u010dnosti, \u017ee m\u00e1me mal\u00fd hack pro spr\u00e1vu p\u0159es WEB rozhran\u00ed, ale jak uk\u00e1zala praxe pou\u017e\u00edv\u00e1n\u00ed takov\u00e9ho modelu v\u00edce ne\u017e rok, WEB nen\u00ed tak pot\u0159ebn\u00fd. Po nasazen\u00ed jsme m\u011bli p\u0159\u00e1n\u00ed zav\u00e9st seznam web\u016f do datab\u00e1ze atd. Po\u010det zablokovan\u00fdch hostitel\u016f je v\u00edce ne\u017e 250 + des\u00edtka adresn\u00edch prostor\u016f. Opravdu nast\u00e1v\u00e1 probl\u00e9m p\u0159i p\u0159echodu na web p\u0159es https spojen\u00ed, jako\u017e i syst\u00e9mov\u00fd administr\u00e1tor m\u00e1m v\u00fdhrady k prohl\u00ed\u017ee\u010d\u016fm :), ale to jsou ojedin\u011bl\u00e9 p\u0159\u00edpady, v\u011bt\u0161ina aktivac\u00ed bez p\u0159\u00edstupu k zdroji je na na\u0161\u00ed stran\u011b, stejn\u011b \u00fasp\u011b\u0161n\u011b blokujeme Opera VPN, pluginy jako friGate a telemetry od Microsoftu.<\/p>\n<p><img decoding=\"async\" alt=\"Iptables a filtrov\u00e1n\u00ed provozu proti chud\u00fdm a leniv\u00fdm jinak sm\u00fd\u0161lej\u00edc\u00edm\" src=\"\/wp-content\/uploads\/2019\/10\/c08d381986d74a8000d5a77e4a34e750.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/471402\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0439 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043c\u043e\u0433\u0443\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u044a\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u043e\u043d\u0430 \u0438\u043b\u0438 \u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432. \u0417\u0430\u0447\u0435\u043c \u0438\u0437\u043e\u0431\u0440\u0435\u0442\u0430\u0442\u044c \u0432\u0435\u043b\u043e\u0441\u0438\u043f\u0435\u0434 \u0442\u043e\u0433\u0434\u0430, \u043a\u043e\u0433\u0434\u0430 \u0435\u0441\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b \u0434\u043b\u044f \u043d\u0430\u0448\u0438\u0445 \u0437\u0430\u0434\u0430\u0447, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440: Zeroshell, pfSense, ClearOS. \u0415\u0449\u0435 \u043e\u0434\u0438\u043d \u0432\u043e\u043f\u0440\u043e\u0441 \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u0443 \u043d\u0430\u0447\u0430\u043b\u044c\u0441\u0442\u0432\u0430: \u0410 \u0435\u0441\u0442\u044c \u043b\u0438 \u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0430? \u0423 \u043d\u0430\u0441 \u0431\u044b\u043b \u043e\u043f\u044b\u0442 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":29247,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38982","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0439 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043c\u043e\u0433\u0443\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u044a\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u043e\u043d\u0430 \u0438\u043b\u0438 \u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Iptables \u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0442 \u0431\u0435\u0434\u043d\u044b\u0445 \u0438 \u043b\u0435\u043d\u0438\u0432\u044b\u0445 \u0438\u043d\u0430\u043a\u043e\u043c\u044b\u0441\u043b\u044f\u0449\u0438\u0445 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0439 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043c\u043e\u0433\u0443\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u044a\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u043e\u043d\u0430 \u0438\u043b\u0438 \u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:27:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:27:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Iptables a filtrov\u00e1n\u00ed provozu od chud\u00fdch a l\u00edn\u00fdch alternativn\u00edch my\u0161lenk\u00e1\u0159\u016f | ProHoster","description":"Relevance of blocking access to prohibited resources concerns any admin who may officially face accusations of non-compliance with the law or orders from relevant authorities.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Iptables \u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0442 \u0431\u0435\u0434\u043d\u044b\u0445 \u0438 \u043b\u0435\u043d\u0438\u0432\u044b\u0445 \u0438\u043d\u0430\u043a\u043e\u043c\u044b\u0441\u043b\u044f\u0449\u0438\u0445 | ProHoster","og:description":"\u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0439 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043c\u043e\u0433\u0443\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u044a\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u043e\u043d\u0430 \u0438\u043b\u0438 \u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:27:11+00:00","article:modified_time":"2019-10-31T19:27:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38982","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 00:15:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:59:27","updated":"2026-01-24 00:15:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/38982","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=38982"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/38982\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/29247"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=38982"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=38982"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=38982"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}