{"id":38982,"date":"2019-10-31T22:27:11","date_gmt":"2019-10-31T19:27:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih\/"},"modified":"2019-10-31T22:27:11","modified_gmt":"2019-10-31T19:27:11","slug":"iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih","title":{"rendered":"Iptables \u0219i filtrarea traficului de la cei s\u0103raci \u0219i lene\u0219i cu p\u0103reri diferite","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Relevan\u021ba bloc\u0103rii accesului la resursele interzise \u00eei afecteaz\u0103 pe orice administrator care ar putea fi acuzat oficial de ne\u00eendeplinirea legii sau a dispozi\u021biilor autorit\u0103\u021bilor competente. <\/p>\n<p><img decoding=\"async\" alt=\"Iptables \u0219i filtrarea traficului de la cei s\u0103raci \u0219i lene\u0219i cu p\u0103reri diferite\" src=\"\/wp-content\/uploads\/2019\/10\/add48d25f687f411cd3c9235c9df61c1.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDe ce s\u0103 reinvent\u0103m roata c\u00e2nd exist\u0103 programe \u0219i distribu\u021bii specializate pentru nevoile noastre, de exemplu: Zeroshell, pfSense, ClearOS. <\/p>\n<p>O alt\u0103 \u00eentrebare a venit de la superiori: Are produsul utilizat certificat de securitate de la statul nostru?<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nAm avut experien\u021b\u0103 cu distribu\u021biile men\u021bionate:<\/p>\n<ul>\n<li>Zeroshell - dezvoltatorii ne-au oferit o licen\u021b\u0103 gratuit\u0103 pe 2 ani, dar s-a dovedit c\u0103 distribu\u021bia care ne interesa nu \u00eendeplinea func\u021bia critic\u0103 pentru noi;<\/li>\n<li>pfSense - respect \u0219i apreciere, dar \u00een acela\u0219i timp plictisitor, obi\u0219nuin\u021b\u0103 cu linia de comand\u0103 a firewall-ului FreeBSD \u0219i nu este suficient de confortabil pentru noi (cred c\u0103 e vorba de obi\u0219nuin\u021b\u0103, dar nu a fost \u00abcalea cea bun\u0103\u00bb);<\/li>\n<li>ClearOS - pe hardware-ul nostru s-a dovedit foarte lent, nu am ajuns la test\u0103ri serioase, de aceea, de ce interfe\u021be at\u00e2t de greoaie? <\/li>\n<li>Ideco SELECTA. Despre produsul \u00abIdeco\u00bb este o alt\u0103 poveste, un produs interesant, dar din motive politice, nu este pentru noi, plus c\u0103 vrem s\u0103 discut\u0103m despre licen\u021ba pentru Linux, Roundcube etc. De unde au dedus c\u0103, \u00abt\u0103ind\u00bb interfa\u021ba \u00een <b>Python<\/b> \u0219i lu\u00e2nd drepturile de superutilizator pot vinde un produs complet alc\u0103tuit din modulele dezvoltate \u0219i revizuite de comunitatea internet, distribuite sub GPL&amp;etc.<\/li>\n<\/ul>\n<p>\n\u00cen\u021beleg c\u0103 acum voi primi reac\u021bii negative cu cerin\u021be de a explica \u00een detaliu sentimentele mele subiective, dar vreau s\u0103 spun c\u0103 acest nod de re\u021bea este de asemenea un echilibrator de trafic pentru 4 canale externe c\u0103tre Internet, fiecare canal av\u00e2nd propriile sale particularit\u0103\u021bi. De asemenea, o piatr\u0103 de temelie a fost necesitatea de a avea unul dintre mai multe interfe\u021be de re\u021bea \u00een diferite spa\u021bii de adresare, \u0219i eu <b>sunt preg\u0103tit<\/b> s\u0103 recunosc c\u0103 aplicarea VLAN-urilor \u00een mod constant, indiferent de necesitate, eu <b>nu sunt preg\u0103tit<\/b>. \u00cen utilizare exist\u0103 dispozitive de tip TP-Link TL-R480T+ - se comport\u0103 imperfect, \u00een general cu nuan\u021bele lor. Aceast\u0103 parte pe Linux a fost configurat\u0103 rezonabil datorit\u0103 site-ului oficial Ubuntu. <noindex><a rel=\"nofollow\" href=\"https:\/\/help.ubuntu.ru\/wiki\/ip_balancing\">IP-Balancing: combin\u0103m mai multe canale de internet \u00eentr-unul.<\/a><\/noindex>. Fiecare canal poate \u201ec\u0103dea\u201d \u00een orice moment, la fel cum poate \u0219i \u201eurca\u201d. Dac\u0103 e\u0219ti interesat de un script care func\u021bioneaz\u0103 \u00een acest moment (iar asta merit\u0103 o publica\u021bie separat\u0103) \u2014 scrie \u00een comentarii. <\/p>\n<p>Solu\u021bia discutat\u0103 nu pretinde a fi unic\u0103, dar vreau s\u0103 pun o \u00eentrebare: \u201eDe ce s\u0103 ne adapt\u0103m la produse externe \u00eendoielnice cu cerin\u021be hardware serioase c\u00e2nd putem considera o alternativ\u0103?\u201d.<\/p>\n<p>Dac\u0103 \u00een Rusia exist\u0103 o list\u0103 a Roskomnadzor, \u00een Ucraina exist\u0103 o anex\u0103 la Decizia Consiliului de Securitate Na\u021bional\u0103 (de exemplu, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.president.gov.ua\/documents\/1262018-24150\">iat\u0103<\/a><\/noindex>), la nivel local, \u0219efii nu dorm nici ei. De exemplu, ni s-a dat o list\u0103 a site-urilor interzise, care, conform conducerii, afecteaz\u0103 productivitatea la locul de munc\u0103. <\/p>\n<p>Comunic\u00e2nd cu colegii de la alte companii, unde sunt interzise, din principiu, toate site-urile \u0219i doar cu cererea \u0219i permisiunea \u0219efului po\u021bi ob\u021bine acces la un site specific, am z\u00e2mbit respectuos, g\u00e2ndindu-ne \u0219i \u201emedit\u00e2nd asupra problemei\u201d, am realizat c\u0103 via\u021ba chiar este bun\u0103 \u0219i am \u00eenceput c\u0103ut\u0103rile noastre.<\/p>\n<p>Av\u00e2nd posibilitatea nu doar s\u0103 analiz\u0103m ce scriu \u00een \u201ec\u0103r\u021bile gospodinelor\u201d despre filtrarea traficului, ci \u0219i s\u0103 observ\u0103m ce se \u00eent\u00e2mpl\u0103 pe canalele diferitelor furnizori, am remarcat urm\u0103toarele re\u021bete (orice capturi de ecran sunt pu\u021bin decupate, v\u0103 rog s\u0103 \u00een\u021belege\u021bi):<\/p>\n<p>Furnizor 1<br \/>\n \u2014 nu se complic\u0103 \u0219i impune servere DNS proprii \u0219i un server proxy transparent. A\u0219a c\u0103?\u2026 totu\u0219i avem acces acolo unde trebuie (dac\u0103 ne trebuie :))<\/p>\n<p>Furnizor 2<br \/>\n \u2014 consider\u0103 c\u0103 furnizorul s\u0103u superior ar trebui s\u0103 se ocupe de acest lucru, suportul tehnic al furnizorului superior a recunoscut chiar de ce nu pot deschide site-ul necesar care nu este interzis. Cred c\u0103 imaginea va s\u0103 te amuze \ud83d\ude42<\/p>\n<p><img decoding=\"async\" alt=\"Iptables \u0219i filtrarea traficului de la cei s\u0103raci \u0219i lene\u0219i cu p\u0103reri diferite\" src=\"\/wp-content\/uploads\/2019\/10\/ea50d22bb4ab91bfdd52ceae9ccde0e2.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSe pare c\u0103 ei traduc numele site-urilor interzise \u00een adrese IP \u0219i blocheaz\u0103 anume IP-ul (nu \u00eei \u00eengrijoreaz\u0103 c\u0103 pe aceast\u0103 adres\u0103 IP pot fi \u0219i 20 de site-uri). <\/p>\n<p>Furnizor 3<br \/>\n \u2014 permite traficul acolo, dar \u00eenapoi pe rut\u0103 nu-l permite.<\/p>\n<p>Furnizor 4<br \/>\n \u2014 interzice toate manevrele cu pachetele \u00een direc\u021bia indicat\u0103.<\/p>\n<p>Ce trebuie s\u0103 facem cu VPN-ul (respect pentru browserul Opera) \u0219i plugin-urile pentru browsere? Juc\u00e2ndu-ne ini\u021bial cu nodul Mikrotik, am ajuns chiar la o re\u021bet\u0103 consumatoare de resurse pe L7, de care a trebuit s\u0103 ne desp\u0103r\u021bim ulterior (num\u0103rul numelui interzis poate fi destul de mare, devine trist c\u00e2nd, pe l\u00e2ng\u0103 atribu\u021biile directe pe rute, pe 30 de expresii, \u00eenc\u0103rc\u0103tura procesorului PPC460GT ajunge la 100%).<\/p>\n<p><img decoding=\"async\" alt=\"Iptables \u0219i filtrarea traficului de la cei s\u0103raci \u0219i lene\u0219i cu p\u0103reri diferite\" src=\"\/wp-content\/uploads\/2019\/10\/c71db959ded51da02ad43e8e14a4144b.jpg\" style=\"display:block;margin: 0 auto;\" \/>.<\/p>\n<p>Ce a devenit clar:<br \/>\nDNS-ul pe 127.0.0.1 nu este deloc o solu\u021bie universal\u0103, versiunile moderne ale browserelor permit totu\u0219i s\u0103 se ocoleasc\u0103 aceste probleme. Nu se pot restric\u021biona to\u021bi utilizatorii cu drepturi limitate \u0219i nu trebuie s\u0103 uit\u0103m de num\u0103rul extrem de mare de alternative DNS. Internetul nu este static, iar pe l\u00e2ng\u0103 adresele DNS noi, site-urile interzise cump\u0103r\u0103 adrese noi, \u00ee\u0219i schimb\u0103 domeniile de nivel superior, pot ad\u0103uga\/elimina simboluri din adresa lor. Totu\u0219i, exist\u0103 ceva de genul:<\/p>\n<pre><code class=\"bash\">ip route add blackhole 1.2.3.4<\/code><\/pre>\n<p>\nAr fi destul de eficient s\u0103 ob\u021binem o list\u0103 de adrese IP din lista site-urilor interzise, dar din motivele men\u021bionate mai sus, am trecut la considerentele despre Iptables. Exist\u0103 deja un echilibru activ pe CentOS Linux release 7.5.1804.<\/p>\n<p>Internetul utilizatorului ar trebui s\u0103 fie rapid, iar browserul nu ar trebui s\u0103 a\u0219tepte o jum\u0103tate de minut, concluzion\u00e2nd c\u0103 aceast\u0103 pagin\u0103 nu este disponibil\u0103. Dup\u0103 c\u0103ut\u0103ri \u00eendelungate, am ajuns la acest model:<br \/>\nFi\u0219ier 1 -&gt; <b>\/script\/denied_host<\/b>, lista numelui interzis:<\/p>\n<pre><code class=\"plaintext\">test.test\nblablabla.bubu\ntorrent\nporno<\/code><\/pre>\n<p>\nFi\u0219ier 2 -&gt; <b>\/script\/denied_range<\/b>, lista spa\u021biilor de adresare \u0219i adreselor interzise:<\/p>\n<pre><code class=\"plaintext\">192.168.111.0\/24\n241.242.0.0\/16<\/code><\/pre>\n<p>\nFi\u0219ier-script 3 -&gt; <b>ipt.sh<\/b>, care execut\u0103 lucrul cu iptables:<\/p>\n<pre><code class=\"bash\"># \u0441\u0447\u0438\u0442\u044b\u0432\u0430\u0435\u043c \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438\u0437 \u043f\u0435\u0440\u0435\u0447\u043d\u0435\u0439 \u0444\u0430\u0439\u043b\u043e\u0432\nHOSTS=`cat \/script\/denied_host | grep -v '^#'`\nRANGE=`cat \/script\/denied_range | grep -v '^#'`\necho \"Stopping firewall and allowing everyone...\"\n# \u0441\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u0435\u043c \u0432\u0441\u0435 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 iptables, \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u044f \u0442\u043e \u0447\u0442\u043e \u043d\u0435 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043e\nsudo iptables -F\nsudo iptables -X\nsudo iptables -t nat -F\nsudo iptables -t nat -X\nsudo iptables -t mangle -F\nsudo iptables -t mangle -X\nsudo iptables -P INPUT ACCEPT\nsudo iptables -P FORWARD ACCEPT\nsudo iptables -P OUTPUT ACCEPT\n#\u0440\u0435\u0448\u0430\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430\u0445 (\u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u043d\u0430\u0448\u0435\u0439 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b)\nsudo sh rout.sh\n# \u0446\u0438\u043a\u043b\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044f \u043a\u0430\u0436\u0434\u0443\u044e \u0441\u0442\u0440\u043e\u043a\u0443 \u0444\u0430\u0439\u043b\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0441\u0442\u0440\u043e\u043a\u0438\nfor i in $HOSTS; do\nsudo iptables -I FORWARD -m string --string $i --algo bm --from 1 --to 600 -p tcp -j REJECT --reject-with tcp-reset;\nsudo iptables -I FORWARD -m string --string $i --algo bm --from 1 --to 600 -p udp -j DROP;\ndone\n# \u0446\u0438\u043a\u043b\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044f \u043a\u0430\u0436\u0434\u0443\u044e \u0441\u0442\u0440\u043e\u043a\u0443 \u0444\u0430\u0439\u043b\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0430\u0434\u0440\u0435\u0441\u0430\nfor i in $RANGE; do\nsudo iptables -I FORWARD -p UDP -d $i -j DROP;\nsudo iptables -I FORWARD -p TCP  -d $i -j REJECT --reject-with tcp-reset;\ndone\n<\/code><\/pre>\n<p>\nUtilizarea sudo se datoreaz\u0103 faptului c\u0103 avem un mic hack pentru gestionarea prin interfa\u021ba WEB, dar, a\u0219a cum a ar\u0103tat experien\u021ba utiliz\u0103rii acestui model de peste un an, interfa\u021ba WEB nu este at\u00e2t de necesar\u0103. Dup\u0103 implementare, a existat dorin\u021ba de a introduce lista de site-uri \u00een baza de date etc. Num\u0103rul de gazde blocate este de peste 250 + o duzin\u0103 de spa\u021bii de adresare. Exist\u0103 \u00eentr-adev\u0103r o problem\u0103 c\u00e2nd acces\u0103m un site prin conexiune https, la fel ca \u0219i administratorului de sistem, am observa\u021bii legate de browsere :), dar acestea sunt cazuri particulare, majoritatea problemelor de acces la resurs\u0103 sunt totu\u0219i de partea noastr\u0103, reu\u0219ind, de asemenea, s\u0103 bloc\u0103m Opera VPN, plugin-uri tip friGate \u0219i telemetria de la Microsoft.<\/p>\n<p><img decoding=\"async\" alt=\"Iptables \u0219i filtrarea traficului de la cei s\u0103raci \u0219i lene\u0219i cu p\u0103reri diferite\" src=\"\/wp-content\/uploads\/2019\/10\/c08d381986d74a8000d5a77e4a34e750.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/471402\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0439 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043c\u043e\u0433\u0443\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u044a\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u043e\u043d\u0430 \u0438\u043b\u0438 \u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432. \u0417\u0430\u0447\u0435\u043c \u0438\u0437\u043e\u0431\u0440\u0435\u0442\u0430\u0442\u044c \u0432\u0435\u043b\u043e\u0441\u0438\u043f\u0435\u0434 \u0442\u043e\u0433\u0434\u0430, \u043a\u043e\u0433\u0434\u0430 \u0435\u0441\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b \u0434\u043b\u044f \u043d\u0430\u0448\u0438\u0445 \u0437\u0430\u0434\u0430\u0447, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440: Zeroshell, pfSense, ClearOS. \u0415\u0449\u0435 \u043e\u0434\u0438\u043d \u0432\u043e\u043f\u0440\u043e\u0441 \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u0443 \u043d\u0430\u0447\u0430\u043b\u044c\u0441\u0442\u0432\u0430: \u0410 \u0435\u0441\u0442\u044c \u043b\u0438 \u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0430? \u0423 \u043d\u0430\u0441 \u0431\u044b\u043b \u043e\u043f\u044b\u0442 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":29247,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38982","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0439 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043c\u043e\u0433\u0443\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u044a\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u043e\u043d\u0430 \u0438\u043b\u0438 \u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Iptables \u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0442 \u0431\u0435\u0434\u043d\u044b\u0445 \u0438 \u043b\u0435\u043d\u0438\u0432\u044b\u0445 \u0438\u043d\u0430\u043a\u043e\u043c\u044b\u0441\u043b\u044f\u0449\u0438\u0445 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0439 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043c\u043e\u0433\u0443\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u044a\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u043e\u043d\u0430 \u0438\u043b\u0438 \u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:27:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:27:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Iptables \u0219i filtrarea traficului de la cei s\u0103raci \u0219i len\u021bi \u0219i cei care g\u00e2ndesc diferit | ProHoster","description":"Relevan\u021ba bloc\u0103rii accesului la resursele interzise \u00eei afecteaz\u0103 pe orice administrator care ar putea fi acuzat oficial de ne\u00eendeplinirea legii sau a dispozi\u021biilor autorit\u0103\u021bilor competente.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Iptables \u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0442 \u0431\u0435\u0434\u043d\u044b\u0445 \u0438 \u043b\u0435\u043d\u0438\u0432\u044b\u0445 \u0438\u043d\u0430\u043a\u043e\u043c\u044b\u0441\u043b\u044f\u0449\u0438\u0445 | ProHoster","og:description":"\u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0439 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043c\u043e\u0433\u0443\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u044a\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u043e\u043d\u0430 \u0438\u043b\u0438 \u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:27:11+00:00","article:modified_time":"2019-10-31T19:27:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38982","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 00:15:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:59:27","updated":"2026-01-24 00:15:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/38982","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=38982"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/38982\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/29247"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=38982"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=38982"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=38982"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}