{"id":38982,"date":"2019-10-31T22:27:11","date_gmt":"2019-10-31T19:27:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih\/"},"modified":"2019-10-31T22:27:11","modified_gmt":"2019-10-31T19:27:11","slug":"iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih","title":{"rendered":"Iptables e filtragem de tr\u00e1fego de pensadores pobres e pregui\u00e7osos","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>A relev\u00e2ncia do bloqueio de acessos a recursos proibidos afeta qualquer administrador que possa ser oficialmente responsabilizado por n\u00e3o cumprir a lei ou as ordens das autoridades competentes. <\/p>\n<p><img decoding=\"async\" alt=\"Iptables e filtragem de tr\u00e1fego de pensadores pobres e pregui\u00e7osos\" src=\"\/wp-content\/uploads\/2019\/10\/add48d25f687f411cd3c9235c9df61c1.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPor que reinventar a roda se j\u00e1 existem programas e distribui\u00e7\u00f5es especializadas para nossas tarefas, como: Zeroshell, pfSense, ClearOS. <\/p>\n<p>Outra quest\u00e3o levantada pela ger\u00eancia: O produto usado tem certifica\u00e7\u00e3o de seguran\u00e7a do nosso pa\u00eds?<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nTivemos experi\u00eancia com as distribui\u00e7\u00f5es mencionadas:<\/p>\n<ul>\n<li>Zeroshell \u2014 os desenvolvedores at\u00e9 nos ofereceram uma licen\u00e7a gratuita por 2 anos, mas o que nos interessava n\u00e3o executava a fun\u00e7\u00e3o cr\u00edtica de modo l\u00f3gico para n\u00f3s;<\/li>\n<li>pfSense \u2014 respeito e honra, mas ao mesmo tempo \u00e9 mon\u00f3tono, acostumar-se com a linha de comando do firewall FreeBSD n\u00e3o foi suficientemente conveniente para n\u00f3s (acho que \u00e9 quest\u00e3o de h\u00e1bito, mas n\u00e3o era 'o caminho');<\/li>\n<li>ClearOS \u2014 em nosso hardware estava muito lento, n\u00e3o conseguimos chegar a testes s\u00e9rios, ent\u00e3o por que ter interfaces t\u00e3o pesadas? <\/li>\n<li>Ideco SELECTA. O produto 'Aideco' \u00e9 uma conversa \u00e0 parte, \u00e9 um produto interessante, mas por motivos pol\u00edticos n\u00e3o \u00e9 para n\u00f3s, e tamb\u00e9m quero 'puxar' sobre a licen\u00e7a para o mesmo Linux, Roundcube, etc. De onde eles tiraram que \u2018a partir do momento que modificam\u2019 a interface, <b>Python<\/b> e tirando direitos de superusu\u00e1rio, podem vender um produto final composto por m\u00f3dulos desenvolvidos e aprimorados pela comunidade de internet distribu\u00eddos sob GPL&amp;etc.<\/li>\n<\/ul>\n<p>\nEntendo que agora serei alvo de cr\u00edticas negativas pedindo para justificar detalhadamente minhas percep\u00e7\u00f5es subjetivas, mas quero dizer que esse n\u00f3 da rede tamb\u00e9m \u00e9 um balanceador de tr\u00e1fego para 4 canais externos para a Internet, e cada canal tem suas particularidades. Outro ponto cr\u00edtico foi a necessidade de um dos v\u00e1rios interfaces de rede funcionar em diferentes espa\u00e7os de endere\u00e7o, e eu <b>estou<\/b> pronto <b>para reconhecer que n\u00e3o estou preparado para aplicar VLANs em qualquer lugar onde seja necess\u00e1rio ou n\u00e3o.<\/b>Em uso, temos dispositivos como o TP-Link TL-R480T+ \u2014 eles n\u00e3o se comportam perfeitamente, no geral t\u00eam suas nuances. Essa parte no Linux foi conseguida em configura\u00e7\u00f5es razo\u00e1veis gra\u00e7as ao site oficial do Ubuntu. <noindex><a rel=\"nofollow\" href=\"https:\/\/help.ubuntu.ru\/wiki\/ip_balancing\">Balanceamento IP: unindo v\u00e1rios canais de internet em um s\u00f3.<\/a><\/noindex>. E cada um dos canais pode \"parar\" a qualquer momento, assim como pode subir. Se voc\u00ea estiver interessado em um script que funcione no momento (isso merece uma publica\u00e7\u00e3o separada) \u2014 escreva nos coment\u00e1rios. <\/p>\n<p>A solu\u00e7\u00e3o em quest\u00e3o n\u00e3o se destaca como \u00fanica, mas gostaria de fazer a pergunta: \"Por que em uma empresa adaptar-se a produtos duvidosos de terceiros com requisitos de hardware exigentes quando se pode considerar uma alternativa?\".<\/p>\n<p>Se na R\u00fassia h\u00e1 uma lista da Roskomnadzor, na Ucr\u00e2nia \u2014 um aplicativo da Decis\u00e3o do Conselho de Seguran\u00e7a Nacional (por exemplo, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.president.gov.ua\/documents\/1262018-24150\">aqui<\/a><\/noindex>), os gestores locais tamb\u00e9m est\u00e3o atentos. Por exemplo, recebemos uma lista de sites proibidos, que, segundo a dire\u00e7\u00e3o, prejudicam a produtividade no trabalho. <\/p>\n<p>Ao conversar com colegas em outras empresas, onde todos os sites est\u00e3o suspensos por padr\u00e3o e o acesso a um site espec\u00edfico s\u00f3 pode ser concedido com a permiss\u00e3o do chefe, pensei respeitosamente e, ap\u00f3s \"refletir sobre o problema\", percebi que a vida \u00e9 boa e come\u00e7amos nossa busca.<\/p>\n<p>Tendo a oportunidade de n\u00e3o apenas olhar analiticamente o que \u00e9 escrito nos \"livros de donas de casa\" sobre a filtragem de tr\u00e1fego, mas tamb\u00e9m observar o que acontece nos canais de diferentes provedores, notamos as seguintes receitas (todas as capturas de tela est\u00e3o um pouco cortadas, pe\u00e7o que entendam):<\/p>\n<p>Provedor 1<br \/>\n \u2014 n\u00e3o se preocupa e imp\u00f5e seus pr\u00f3prios servidores DNS e um proxy transparente. Bem, e da\u00ed?... Pelo menos temos acesso ao que precisamos (se precisarmos disso :))<\/p>\n<p>Provedor 2<br \/>\n \u2014 acredita que seu provedor superior deve se preocupar com isso; a equipe de suporte do provedor superior at\u00e9 admitiu por que n\u00e3o consigo acessar o site n\u00e3o proibido que preciso. Acho que a imagem ir\u00e1 divertir voc\u00ea \ud83d\ude42<\/p>\n<p><img decoding=\"async\" alt=\"Iptables e filtragem de tr\u00e1fego de pensadores pobres e pregui\u00e7osos\" src=\"\/wp-content\/uploads\/2019\/10\/ea50d22bb4ab91bfdd52ceae9ccde0e2.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nComo se descobriu, eles traduzem os nomes dos sites proibidos em endere\u00e7os IP e bloqueiam exatamente o IP (n\u00e3o se preocupam que neste IP possam estar hospedados 20 sites). <\/p>\n<p>Provedor 3<br \/>\n \u2014 permite o tr\u00e1fego para l\u00e1, mas n\u00e3o o permite de volta pelo caminho.<\/p>\n<p>Provedor 4<br \/>\n \u2014 pro\u00edbe todas as manipula\u00e7\u00f5es com pacotes na dire\u00e7\u00e3o indicada.<\/p>\n<p>E o que fazer com VPNs (respeito ao navegador Opera) e plugins para navegadores? Brincando inicialmente com um n\u00f3 Mikrotik, at\u00e9 tivemos uma receita pesada para L7, da qual posteriormente tivemos que nos afastar (os nomes proibidos podem ser muitos, \u00e9 triste quando, al\u00e9m de suas responsabilidades diretas nas rotas, em 30 express\u00f5es a carga do CPU PPC460GT chega a 100%).<\/p>\n<p><img decoding=\"async\" alt=\"Iptables e filtragem de tr\u00e1fego de pensadores pobres e pregui\u00e7osos\" src=\"\/wp-content\/uploads\/2019\/10\/c71db959ded51da02ad43e8e14a4144b.jpg\" style=\"display:block;margin: 0 auto;\" \/>.<\/p>\n<p>O que ficou claro:<br \/>\nDNS em 127.0.0.1 n\u00e3o \u00e9 uma panaceia, as vers\u00f5es modernas dos navegadores permitem contornar esses problemas. N\u00e3o \u00e9 poss\u00edvel restringir todos os usu\u00e1rios a direitos limitados, e n\u00e3o devemos esquecer o grande n\u00famero de DNS alternativos. A internet n\u00e3o \u00e9 est\u00e1tica, e al\u00e9m de novos endere\u00e7os DNS, sites proibidos compram novos endere\u00e7os, mudam dom\u00ednios de n\u00edvel superior, podem adicionar\/remover um caractere de seu endere\u00e7o. Mas ainda assim, algo como isso pode sobreviver:<\/p>\n<pre><code class=\"bash\">ip route add blackhole 1.2.3.4<\/code><\/pre>\n<p>\nSeria bastante eficaz obter uma lista de endere\u00e7os IP da lista de sites proibidos, mas, pelas raz\u00f5es mencionadas acima, mudamos para considera\u00e7\u00f5es sobre Iptables. J\u00e1 havia um balanceador ativo na vers\u00e3o 7.5.1804 do CentOS Linux.<\/p>\n<p>A internet do usu\u00e1rio deve ser r\u00e1pida, e o navegador n\u00e3o deve esperar meio minuto, concluindo que a p\u00e1gina n\u00e3o est\u00e1 dispon\u00edvel. Ap\u00f3s longas pesquisas, chegamos a este modelo:<br \/>\nArquivo 1 -&gt; <b>\/script\/denied_host<\/b>, lista de nomes proibidos:<\/p>\n<pre><code class=\"plaintext\">test.test\nblablabla.bubu\ntorrent\nporno<\/code><\/pre>\n<p>\nArquivo 2 -&gt; <b>\/script\/denied_range<\/b>, lista de espa\u00e7os de endere\u00e7os e endere\u00e7os proibidos:<\/p>\n<pre><code class=\"plaintext\">192.168.111.0\/24\n241.242.0.0\/16<\/code><\/pre>\n<p>\nArquivo-script 3 -&gt; <b>ipt.sh<\/b>, executando tarefas com iptables:<\/p>\n<pre><code class=\"bash\"># \u0441\u0447\u0438\u0442\u044b\u0432\u0430\u0435\u043c \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438\u0437 \u043f\u0435\u0440\u0435\u0447\u043d\u0435\u0439 \u0444\u0430\u0439\u043b\u043e\u0432\nHOSTS=`cat \/script\/denied_host | grep -v '^#'`\nRANGE=`cat \/script\/denied_range | grep -v '^#'`\necho \"Stopping firewall and allowing everyone...\"\n# \u0441\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u0435\u043c \u0432\u0441\u0435 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 iptables, \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u044f \u0442\u043e \u0447\u0442\u043e \u043d\u0435 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043e\nsudo iptables -F\nsudo iptables -X\nsudo iptables -t nat -F\nsudo iptables -t nat -X\nsudo iptables -t mangle -F\nsudo iptables -t mangle -X\nsudo iptables -P INPUT ACCEPT\nsudo iptables -P FORWARD ACCEPT\nsudo iptables -P OUTPUT ACCEPT\n#\u0440\u0435\u0448\u0430\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430\u0445 (\u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u043d\u0430\u0448\u0435\u0439 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b)\nsudo sh rout.sh\n# \u0446\u0438\u043a\u043b\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044f \u043a\u0430\u0436\u0434\u0443\u044e \u0441\u0442\u0440\u043e\u043a\u0443 \u0444\u0430\u0439\u043b\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0441\u0442\u0440\u043e\u043a\u0438\nfor i in $HOSTS; do\nsudo iptables -I FORWARD -m string --string $i --algo bm --from 1 --to 600 -p tcp -j REJECT --reject-with tcp-reset;\nsudo iptables -I FORWARD -m string --string $i --algo bm --from 1 --to 600 -p udp -j DROP;\ndone\n# \u0446\u0438\u043a\u043b\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044f \u043a\u0430\u0436\u0434\u0443\u044e \u0441\u0442\u0440\u043e\u043a\u0443 \u0444\u0430\u0439\u043b\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0430\u0434\u0440\u0435\u0441\u0430\nfor i in $RANGE; do\nsudo iptables -I FORWARD -p UDP -d $i -j DROP;\nsudo iptables -I FORWARD -p TCP  -d $i -j REJECT --reject-with tcp-reset;\ndone\n<\/code><\/pre>\n<p>\nO uso do sudo \u00e9 devido a um pequeno hack que temos para gerenciar atrav\u00e9s da interface WEB, mas, como mostrou a experi\u00eancia de uso desse modelo por mais de um ano, a interface WEB n\u00e3o \u00e9 t\u00e3o necess\u00e1ria. Ap\u00f3s a implementa\u00e7\u00e3o, houve o desejo de armazenar a lista de sites em um banco de dados, etc. O n\u00famero de hosts bloqueados \u00e9 superior a 250 + uma d\u00fazia de espa\u00e7os de endere\u00e7os. Realmente h\u00e1 um problema ao acessar sites via conex\u00e3o https e, como administrador de sistema, tenho algumas queixas sobre os navegadores :), mas esses s\u00e3o casos particulares, a maioria das ativa\u00e7\u00f5es de falta de acesso ao recurso ainda est\u00e3o do nosso lado, al\u00e9m disso, conseguimos bloquear o Opera VPN, plugins como friGate e a telemetria da Microsoft.<\/p>\n<p><img decoding=\"async\" alt=\"Iptables e filtragem de tr\u00e1fego de pensadores pobres e pregui\u00e7osos\" src=\"\/wp-content\/uploads\/2019\/10\/c08d381986d74a8000d5a77e4a34e750.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>Fonte: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/471402\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0439 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043c\u043e\u0433\u0443\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u044a\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u043e\u043d\u0430 \u0438\u043b\u0438 \u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432. \u0417\u0430\u0447\u0435\u043c \u0438\u0437\u043e\u0431\u0440\u0435\u0442\u0430\u0442\u044c \u0432\u0435\u043b\u043e\u0441\u0438\u043f\u0435\u0434 \u0442\u043e\u0433\u0434\u0430, \u043a\u043e\u0433\u0434\u0430 \u0435\u0441\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b \u0434\u043b\u044f \u043d\u0430\u0448\u0438\u0445 \u0437\u0430\u0434\u0430\u0447, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440: Zeroshell, pfSense, ClearOS. \u0415\u0449\u0435 \u043e\u0434\u0438\u043d \u0432\u043e\u043f\u0440\u043e\u0441 \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u0443 \u043d\u0430\u0447\u0430\u043b\u044c\u0441\u0442\u0432\u0430: \u0410 \u0435\u0441\u0442\u044c \u043b\u0438 \u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0430? \u0423 \u043d\u0430\u0441 \u0431\u044b\u043b \u043e\u043f\u044b\u0442 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":29247,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38982","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0439 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043c\u043e\u0433\u0443\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u044a\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u043e\u043d\u0430 \u0438\u043b\u0438 \u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"pt_PT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Iptables \u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0442 \u0431\u0435\u0434\u043d\u044b\u0445 \u0438 \u043b\u0435\u043d\u0438\u0432\u044b\u0445 \u0438\u043d\u0430\u043a\u043e\u043c\u044b\u0441\u043b\u044f\u0449\u0438\u0445 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0439 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043c\u043e\u0433\u0443\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u044a\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u043e\u043d\u0430 \u0438\u043b\u0438 \u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:27:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:27:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Iptables e filtragem de tr\u00e1fego de pobres e pregui\u00e7osos dissidentes | ProHoster","description":"A relev\u00e2ncia do bloqueio de acessos a recursos proibidos afeta qualquer administrador que possa ser oficialmente responsabilizado por n\u00e3o cumprir a lei ou as ordens das autoridades competentes.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Iptables \u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0442 \u0431\u0435\u0434\u043d\u044b\u0445 \u0438 \u043b\u0435\u043d\u0438\u0432\u044b\u0445 \u0438\u043d\u0430\u043a\u043e\u043c\u044b\u0441\u043b\u044f\u0449\u0438\u0445 | ProHoster","og:description":"\u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0439 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043c\u043e\u0433\u0443\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u044a\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u043e\u043d\u0430 \u0438\u043b\u0438 \u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432.","og:url":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:27:11+00:00","article:modified_time":"2019-10-31T19:27:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38982","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 00:15:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:59:27","updated":"2026-01-24 00:15:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/38982","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=38982"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/38982\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/29247"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=38982"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=38982"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=38982"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}