{"id":38982,"date":"2019-10-31T22:27:11","date_gmt":"2019-10-31T19:27:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih\/"},"modified":"2019-10-31T22:27:11","modified_gmt":"2019-10-31T19:27:11","slug":"iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih","title":{"rendered":"Iptables ja liikluse filtreerimine n\u00f5rkade ja laiskade m\u00f5tetega inimeste eest","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>K\u00fclastuste blokeerimise vajadus, mis on seotud keelatud ressurssidega, puudutab iga administraatorit, kellele v\u00f5ivad ametlikult esitada seaduse v\u00f5i vastava asutuse korralduse mitten\u00e4itamise s\u00fc\u00fcdistuse. <\/p>\n<p><img decoding=\"async\" alt=\"Iptables ja liikluse filtreerimine n\u00f5rkade ja laiskade m\u00f5tetega inimeste eest\" src=\"\/wp-content\/uploads\/2019\/10\/add48d25f687f411cd3c9235c9df61c1.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMiks leiutada ratast, kui olemas on spetsialiseeritud programmid ja distributeeringud meie \u00fclesannete jaoks, n\u00e4iteks: Zeroshell, pfSense, ClearOS. <\/p>\n<p>Veel \u00fcks k\u00fcsimus tuli juhtkonnalt: Kas kasutataval tootel on meie riigi turvasertifikaat?<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nMeil on olnud kogemusi nimetatud distributeeringute kasutamisel:<\/p>\n<ul>\n<li>Zeroshell \u2014 arendajad kinkisid meile kaheaastase litsentsi, kuid selgus, et huvipakkuv distributeering t\u00e4itis meie jaoks kriitiliselt olulist funktsiooni ebaloogiliselt;<\/li>\n<li>pfSense \u2014 austus ja tunnustus, samas igav, \u00f5ppimine FreeBSD tulemuse k\u00e4skude kasutamisega ning ei olnud meie jaoks piisavalt mugav (arvan, et see on harjumuse k\u00fcsimus, kuid see ei osutunud \"\u00f5igeks teeks\");<\/li>\n<li>ClearOS \u2014 meie riistvaral osutus v\u00e4ga aeglaseks, t\u00f5sise testimiseni ei j\u00f5udnud, nii et miks sellised rasked liidesed? <\/li>\n<li>Ideco SELECTA. Toote \u00f6eldakse, et \"Ideco\" on huvitav, kuid poliitilistel p\u00f5hjustel pole see meie jaoks sobilik; ja ma tahaksin \"suu teha\" nende suhtes sama Linuxi, Roundcube'i jne litsentside osas. Kust nad said, et nad saavad \"liidavad\" liidese ja <b>Python<\/b> \u00e4ra v\u00f5tma superkasutaja \u00f5igused, et m\u00fc\u00fca valmis toode, mis koosneb kogukonna arendatud ja \u00fcmber t\u00f6\u00f6tatud moodulitest, mida levitatakse GPL&amp;jne. alusel.<\/li>\n<\/ul>\n<p>\nM\u00f5istan, et n\u00fc\u00fcd v\u00f5ivad minu suunas tulla negatiivsed kriitikad, mis n\u00f5uavad minu subjektiivsete tunnetuste \u00fcksikasjalikku p\u00f5hjendamist, kuid tahan \u00f6elda, et see v\u00f5rgus\u00f5lm on samuti 4 v\u00e4lise kanali liikluse tasakaalustaja Internetti, kusjuures igal kanalil on omad erilised omadused. Veelgi enam, oluline oli, et \u00fcks mitmest v\u00f5rguliidesele t\u00f6\u00f6tas erinevates aadressiruumides, ja ma <b>olen valmis<\/b> tunnustama, et ma ei ole valmis VLAN-e igal pool kasutama, kus nad ei ole vajalikud. Kasutuses on seadmed nagu TP-Link TL-R480T+, mis ei k\u00e4itu ideaalselt, \u00fcldiselt on neil oma n\u00fcansid. Selles osas \u00f5nnestus Linux seadistada, t\u00e4nu Ubuntu ametlikule veebisaidile. <b>\u043d\u0435 \u0433\u043e\u0442\u043e\u0432<\/b>. \u0412 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0435\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0442\u0438\u043f\u0430 TP-Link TL-R480T+ \u2014 \u0432\u0435\u0434\u0443\u0442 \u0441\u0435\u0431\u044f \u043d\u0435 \u0438\u0434\u0435\u0430\u043b\u044c\u043d\u043e, \u0432 \u043e\u0431\u0449\u0435\u043c \u0441\u043e \u0441\u0432\u043e\u0438\u043c\u0438 \u043d\u044e\u0430\u043d\u0441\u0430\u043c\u0438. \u042d\u0442\u0443 \u0447\u0430\u0441\u0442\u044c \u043d\u0430 Linux \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u043e\u0441\u044c \u0432\u043c\u0435\u043d\u044f\u0435\u043c\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043e\u0444.\u0441\u0430\u0439\u0442\u0443 Ubuntu <noindex><a rel=\"nofollow\" href=\"https:\/\/help.ubuntu.ru\/wiki\/ip_balancing\">IP-Balans: \u00fchendame mitu internetikanalit \u00fchte<\/a><\/noindex>. Iga kanal v\u00f5ib igal hetkel \"kukutada\", aga ka t\u00f5usta. Kui huvitab skript, mis hetkel t\u00f6\u00f6tab (ja sellele tuleks eraldi v\u00e4ljaanne) \u2014 kirjutage kommentaarides. <\/p>\n<p>Arutletav lahendus ei pretendeeri unikaalsusele, aga sooviksin k\u00fcsida: \u201eMiks peaks ettev\u00f5tted kohanduma ebamugavate kahtlaste toodetega, millel on t\u00f5sised riistvaran\u00f5uded, kui v\u00f5iks kaaluda alternatiivset varianti?\u201d.<\/p>\n<p>Kui Venemaal on Roskomnadzori loetelu, siis Ukrainas \u2014 Rakenduses Rahvusliku Julgeoleku N\u00f5ukogu otsuse juurde (nt. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.president.gov.ua\/documents\/1262018-24150\">siin on<\/a><\/noindex>), siis ei maga ka kohapealsed juhid. N\u00e4iteks saime nimekirja keelatud veebilehtedest, mis, nende arvates, halvendavad t\u00f6\u00f6 tootlikkust. <\/p>\n<p>Suheldes kolleegidega teistes ettev\u00f5tetes, kus vaikimisi on keelatud k\u00f5ik veebilehed ja ainult juhtkonna loal saab konkreetsetele veebilehtedele ligip\u00e4\u00e4su, m\u00f5tlesin austavalt naeratades ning probleemi \u201e\u00fcmber m\u00f5eldes\u201d, et elu on siiski kena, ja alustasime oma otsingut.<\/p>\n<p>Olles v\u00f5imalus anal\u00fc\u00fctiliselt vaadata, mida kirjutatakse \u201ekoduperenaiste raamatutes\u201c liikluse filtreerimise kohta, ja vaadata, mis toimub erinevate teenusepakkujate kanalites, m\u00e4rkisime j\u00e4rgmised retseptid (k\u00f5ik ekraanipildid on veidi k\u00e4rbitud, palun m\u00f5ista):<\/p>\n<p>Teenusepakkuja 1<br \/>\n \u2014 ei j\u00e4\u00e4 muretsema ja sunnib oma DNS-servereid ja l\u00e4bipaistvat proksiserverit. Mis seal siis on?.. v\u00e4hemalt on meil juurdep\u00e4\u00e4s sinna, kuhu on vaja (kui seda vaja on :))<\/p>\n<p>Teenusepakkuja 2<br \/>\n \u2014 arvab, et tema \u00fclemine teenusepakkuja peaks selle eest hoolitsema, \u00fclemise teenusepakkuja tehniline tugi isegi tunnistas, miks ma ei saa avada vajalikku, mitte keelatud veebisaiti. Ma arvan, et see pilt teid r\u00f5\u00f5mustab \ud83d\ude42<\/p>\n<p><img decoding=\"async\" alt=\"Iptables ja liikluse filtreerimine n\u00f5rkade ja laiskade m\u00f5tetega inimeste eest\" src=\"\/wp-content\/uploads\/2019\/10\/ea50d22bb4ab91bfdd52ceae9ccde0e2.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKuna selgus, muundavad nad keelatud saitide nimed IP-aadressideks ja blokeerivad just IP-d (nende jaoks ei ole probleem, et sellel IP-aadressil v\u00f5ib olla 20 saiti). <\/p>\n<p>Teenusepakkuja 3<br \/>\n \u2014 suunab liikluse sinna, kuid tagasi samal marsruudil ei lase.<\/p>\n<p>Teenusepakkuja 4<br \/>\n \u2014 keelab k\u00f5ik pakettide manipulatsioonid m\u00e4\u00e4ratud suunas.<\/p>\n<p>Kuidas k\u00e4ituda VPN-i (Brauseri Opera austamiseks) ja brauserite pistikprogrammidega? Alguses, katsetades Mikrotik s\u00f5lme, tekkis meil isegi ressursimahukas retsept L7 jaoks, millest pidime hiljem loobuma (keelatud nimesid v\u00f5ib olla rohkem, kurb on see, et peale oma otseste kohustuste t\u00e4itmise marsruutides, koormus PPC460GT protsessoril t\u00f5useb 100% ulatuses 30 erineva v\u00e4ljendi korral).<\/p>\n<p><img decoding=\"async\" alt=\"Iptables ja liikluse filtreerimine n\u00f5rkade ja laiskade m\u00f5tetega inimeste eest\" src=\"\/wp-content\/uploads\/2019\/10\/c71db959ded51da02ad43e8e14a4144b.jpg\" style=\"display:block;margin: 0 auto;\" \/>.<\/p>\n<p>Selgus, et:<br \/>\nDNS aadress 127.0.0.1 ei ole sugugi imerohi; t\u00e4nap\u00e4evased brauseriversioonid v\u00f5imaldavad selliseid probleeme v\u00e4ltida. K\u00f5iki kasutajaid ei saa piirata v\u00e4hendatud \u00f5igustega, ja ei tohi unustada, et on olemas tohutult alternatiivseid DNS-e. Internet ei ole staatiline ja peale uute DNS aadresside, omandavad keelatud saidid uusi aadresse, muudavad tippdomeene ning v\u00f5ivad lisada v\u00f5i eemaldada t\u00e4he oma aadressist. Siiski on midagi, mis v\u00f5iks eksisteerida:<\/p>\n<pre><code class=\"bash\">ip route add blackhole 1.2.3.4<\/code><\/pre>\n<p>\nIdeaalne oleks saada keelatud saitide IP aadresside nimekiri, kuid eespool nimetatud p\u00f5hjustel oleme l\u00e4inud \u00fcle Iptablesi arutelule. Toodud oli juba aktiivne tasakaalustaja CentOS Linux release 7.5.1804-l.<\/p>\n<p>Kasutaja interneti\u00fchendus peab olema kiire ja brauserid ei tohiks oodata pool minutit, eeldades, et see leht pole saadaval. P\u00e4rast pikki otsinguid j\u00f5udsime sellise mudelini:<br \/>\nFail 1 -&gt; <b>\/script\/denied_host<\/b>, keelatud nimede nimekiri:<\/p>\n<pre><code class=\"plaintext\">test.test\nblablabla.bubu\ntorrent\nporno<\/code><\/pre>\n<p>\nFail 2 -&gt; <b>\/script\/denied_range<\/b>, keelatud aadresside ja aadressiruumide nimekiri:<\/p>\n<pre><code class=\"plaintext\">192.168.111.0\/24\n241.242.0.0\/16<\/code><\/pre>\n<p>\nFail-skript 3 -&gt; <b>ipt.sh<\/b>, mis tegeleb iptables'iga:<\/p>\n<pre><code class=\"bash\"># \u0441\u0447\u0438\u0442\u044b\u0432\u0430\u0435\u043c \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438\u0437 \u043f\u0435\u0440\u0435\u0447\u043d\u0435\u0439 \u0444\u0430\u0439\u043b\u043e\u0432\nHOSTS=`cat \/script\/denied_host | grep -v '^#'`\nRANGE=`cat \/script\/denied_range | grep -v '^#'`\necho \"Stopping firewall and allowing everyone...\"\n# \u0441\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u0435\u043c \u0432\u0441\u0435 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 iptables, \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u044f \u0442\u043e \u0447\u0442\u043e \u043d\u0435 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043e\nsudo iptables -F\nsudo iptables -X\nsudo iptables -t nat -F\nsudo iptables -t nat -X\nsudo iptables -t mangle -F\nsudo iptables -t mangle -X\nsudo iptables -P INPUT ACCEPT\nsudo iptables -P FORWARD ACCEPT\nsudo iptables -P OUTPUT ACCEPT\n#\u0440\u0435\u0448\u0430\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430\u0445 (\u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u043d\u0430\u0448\u0435\u0439 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b)\nsudo sh rout.sh\n# \u0446\u0438\u043a\u043b\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044f \u043a\u0430\u0436\u0434\u0443\u044e \u0441\u0442\u0440\u043e\u043a\u0443 \u0444\u0430\u0439\u043b\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0441\u0442\u0440\u043e\u043a\u0438\nfor i in $HOSTS; do\nsudo iptables -I FORWARD -m string --string $i --algo bm --from 1 --to 600 -p tcp -j REJECT --reject-with tcp-reset;\nsudo iptables -I FORWARD -m string --string $i --algo bm --from 1 --to 600 -p udp -j DROP;\ndone\n# \u0446\u0438\u043a\u043b\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044f \u043a\u0430\u0436\u0434\u0443\u044e \u0441\u0442\u0440\u043e\u043a\u0443 \u0444\u0430\u0439\u043b\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0430\u0434\u0440\u0435\u0441\u0430\nfor i in $RANGE; do\nsudo iptables -I FORWARD -p UDP -d $i -j DROP;\nsudo iptables -I FORWARD -p TCP  -d $i -j REJECT --reject-with tcp-reset;\ndone\n<\/code><\/pre>\n<p>\nSudo kasutamine on vajalik, kuna meil on v\u00e4ike nipp haldamiseks WEB-interf\u00e4\u00e4si kaudu. Kuid kui on n\u00e4ha rohkem kui aasta kasutuskogemust, siis ei ole WEB nii vajalik. P\u00e4rast rakendamist tekkis soov, et saidid kantakse andmebaasi jne. Blokeeritud hostide arv \u00fcletab 250 + tosin aadressiruumi. T\u00f5epoolest, HTTPS-\u00fchenduse kaudu saidile \u00fclemisel on probleem, samuti on mul s\u00fcsteemiadministraatorina brauseritele pretensioone :), kuid need on erandid; enamikul juhtudel on juurdep\u00e4\u00e4su puudumise p\u00f5hjused siiski meie pool, samuti blokeerime edukalt Opera VPN, friGate t\u00fc\u00fcpi pluginaid ja Microsofti telemeetria.<\/p>\n<p><img decoding=\"async\" alt=\"Iptables ja liikluse filtreerimine n\u00f5rkade ja laiskade m\u00f5tetega inimeste eest\" src=\"\/wp-content\/uploads\/2019\/10\/c08d381986d74a8000d5a77e4a34e750.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/471402\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0439 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043c\u043e\u0433\u0443\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u044a\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u043e\u043d\u0430 \u0438\u043b\u0438 \u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432. \u0417\u0430\u0447\u0435\u043c \u0438\u0437\u043e\u0431\u0440\u0435\u0442\u0430\u0442\u044c \u0432\u0435\u043b\u043e\u0441\u0438\u043f\u0435\u0434 \u0442\u043e\u0433\u0434\u0430, \u043a\u043e\u0433\u0434\u0430 \u0435\u0441\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b \u0434\u043b\u044f \u043d\u0430\u0448\u0438\u0445 \u0437\u0430\u0434\u0430\u0447, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440: Zeroshell, pfSense, ClearOS. \u0415\u0449\u0435 \u043e\u0434\u0438\u043d \u0432\u043e\u043f\u0440\u043e\u0441 \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u0443 \u043d\u0430\u0447\u0430\u043b\u044c\u0441\u0442\u0432\u0430: \u0410 \u0435\u0441\u0442\u044c \u043b\u0438 \u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0430? \u0423 \u043d\u0430\u0441 \u0431\u044b\u043b \u043e\u043f\u044b\u0442 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":29247,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38982","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0439 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043c\u043e\u0433\u0443\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u044a\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u043e\u043d\u0430 \u0438\u043b\u0438 \u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432. \u0417\u0430\u0447\u0435\u043c \u0438\u0437\u043e\u0431\u0440\u0435\u0442\u0430\u0442\u044c \u0432\u0435\u043b\u043e\u0441\u0438\u043f\u0435\u0434 \u0442\u043e\u0433\u0434\u0430, \u043a\u043e\u0433\u0434\u0430 \u0435\u0441\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b \u0434\u043b\u044f \u043d\u0430\u0448\u0438\u0445 \u0437\u0430\u0434\u0430\u0447, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440: Zeroshell, pfSense, ClearOS. \u0415\u0449\u0435 \u043e\u0434\u0438\u043d \u0432\u043e\u043f\u0440\u043e\u0441 \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u0443 \u043d\u0430\u0447\u0430\u043b\u044c\u0441\u0442\u0432\u0430: \u0410 \u0435\u0441\u0442\u044c \u043b\u0438 \u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0430? \u0423 \u043d\u0430\u0441 \u0431\u044b\u043b \u043e\u043f\u044b\u0442\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Iptables \u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0442 \u0431\u0435\u0434\u043d\u044b\u0445 \u0438 \u043b\u0435\u043d\u0438\u0432\u044b\u0445 \u0438\u043d\u0430\u043a\u043e\u043c\u044b\u0441\u043b\u044f\u0449\u0438\u0445 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0439 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043c\u043e\u0433\u0443\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u044a\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u043e\u043d\u0430 \u0438\u043b\u0438 \u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432. \u0417\u0430\u0447\u0435\u043c \u0438\u0437\u043e\u0431\u0440\u0435\u0442\u0430\u0442\u044c \u0432\u0435\u043b\u043e\u0441\u0438\u043f\u0435\u0434 \u0442\u043e\u0433\u0434\u0430, \u043a\u043e\u0433\u0434\u0430 \u0435\u0441\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b \u0434\u043b\u044f \u043d\u0430\u0448\u0438\u0445 \u0437\u0430\u0434\u0430\u0447, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440: Zeroshell, pfSense, ClearOS. \u0415\u0449\u0435 \u043e\u0434\u0438\u043d \u0432\u043e\u043f\u0440\u043e\u0441 \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u0443 \u043d\u0430\u0447\u0430\u043b\u044c\u0441\u0442\u0432\u0430: \u0410 \u0435\u0441\u0442\u044c \u043b\u0438 \u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0430? \u0423 \u043d\u0430\u0441 \u0431\u044b\u043b \u043e\u043f\u044b\u0442\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:27:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:27:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Iptables ja liikluse filtreerimine vaestelt ja laiskadelt teisitim\u00f5tlejatelt | ProHoster","description":"Keelatud ressursside k\u00fclastuste blokeerimise olulisus puudutab igat administratorit, kellele v\u00f5idakse ametlikult esitada seaduse v\u00f5i vastava organi korralduse mitte t\u00e4itmise s\u00fc\u00fcdistus. Miks leiutada jalgratas siis, kui meie \u00fclesannete jaoks on olemas spetsialiseeritud programmid ja distributsioonid, n\u00e4iteks: Zeroshell, pfSense, ClearOS. Veel \u00fcks k\u00fcsimus tekkis juhtkonnalt: Kas kasutataval tootel on meie riigi turvasertifikaat? Meil on olnud kogemus.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Iptables \u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0442 \u0431\u0435\u0434\u043d\u044b\u0445 \u0438 \u043b\u0435\u043d\u0438\u0432\u044b\u0445 \u0438\u043d\u0430\u043a\u043e\u043c\u044b\u0441\u043b\u044f\u0449\u0438\u0445 | ProHoster","og:description":"\u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0439 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043c\u043e\u0433\u0443\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u044a\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u043e\u043d\u0430 \u0438\u043b\u0438 \u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432. \u0417\u0430\u0447\u0435\u043c \u0438\u0437\u043e\u0431\u0440\u0435\u0442\u0430\u0442\u044c \u0432\u0435\u043b\u043e\u0441\u0438\u043f\u0435\u0434 \u0442\u043e\u0433\u0434\u0430, \u043a\u043e\u0433\u0434\u0430 \u0435\u0441\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b \u0434\u043b\u044f \u043d\u0430\u0448\u0438\u0445 \u0437\u0430\u0434\u0430\u0447, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440: Zeroshell, pfSense, ClearOS. \u0415\u0449\u0435 \u043e\u0434\u0438\u043d \u0432\u043e\u043f\u0440\u043e\u0441 \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u0443 \u043d\u0430\u0447\u0430\u043b\u044c\u0441\u0442\u0432\u0430: \u0410 \u0435\u0441\u0442\u044c \u043b\u0438 \u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0430? \u0423 \u043d\u0430\u0441 \u0431\u044b\u043b \u043e\u043f\u044b\u0442","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:27:11+00:00","article:modified_time":"2019-10-31T19:27:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38982","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 00:15:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:59:27","updated":"2026-01-24 00:15:21"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/38982","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=38982"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/38982\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/29247"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=38982"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=38982"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=38982"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}