{"id":38982,"date":"2019-10-31T22:27:11","date_gmt":"2019-10-31T19:27:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih\/"},"modified":"2019-10-31T22:27:11","modified_gmt":"2019-10-31T19:27:11","slug":"iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih","title":{"rendered":"Iptables a filtrovanie prev\u00e1dzky od chudobn\u00fdch a leniv\u00fdch nes\u00fahlasn\u00fdch.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Relevancia blokovania pr\u00edstupu k zak\u00e1zan\u00fdm zdrojom sa dot\u00fdka ka\u017ed\u00e9ho administr\u00e1tora, ktor\u00fd m\u00f4\u017ee by\u0165 ofici\u00e1lne obvinen\u00fd z poru\u0161enia z\u00e1kona alebo nariaden\u00ed pr\u00edslu\u0161n\u00fdch org\u00e1nov. <\/p>\n<p><img decoding=\"async\" alt=\"Iptables a filtrovanie prev\u00e1dzky od chudobn\u00fdch a leniv\u00fdch nes\u00fahlasn\u00fdch.\" src=\"\/wp-content\/uploads\/2019\/10\/add48d25f687f411cd3c9235c9df61c1.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPre\u010do vym\u00fd\u0161\u013ea\u0165 koleso, ke\u010f existuj\u00fa \u0161pecializovan\u00e9 programy a distrib\u00facie pre na\u0161e \u00falohy, napr\u00edklad: Zeroshell, pfSense, ClearOS. <\/p>\n<p>E\u0161te jedna ot\u00e1zka sa objavila u vedenia: M\u00e1 pou\u017eit\u00fd produkt bezpe\u010dnostn\u00fd certifik\u00e1t na\u0161ej krajiny?<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nM\u00e1me sk\u00fasenosti s uveden\u00fdmi distrib\u00faciami:<\/p>\n<ul>\n<li>Zeroshell \u2014 v\u00fdvoj\u00e1ri dokonca darovali licenciu na 2 roky, ale uk\u00e1zalo sa, \u017ee zauj\u00edmav\u00e1 distrib\u00facia nelogicky plnila pre n\u00e1s kritick\u00fa funkciu;<\/li>\n<li>pfSense \u2014 \u00facta a re\u0161pekt, z\u00e1rove\u0148 nudne, zvykn\u00fa\u0165 si na pr\u00edkazov\u00fd riadok firewalu FreeBSD a nie je to pre n\u00e1s dostato\u010dne pohodln\u00e9 (mysl\u00edm, \u017ee je to ot\u00e1zka zvyku, ale uk\u00e1zalo sa, \u017ee to nebola \"t\u00e1 spr\u00e1vna cesta\");<\/li>\n<li>ClearOS \u2014 na na\u0161om hardv\u00e9ri sa to uk\u00e1zalo by\u0165 ve\u013emi pomal\u00e9, nedostali sme sa k v\u00e1\u017enemu testovaniu, tak pre\u010do tak\u00e9 \u0165a\u017ek\u00e9 rozhrania? <\/li>\n<li>Ideco SELECTA. O produkte 'Aideco' je samostatn\u00e1 diskusia, zauj\u00edmav\u00fd produkt, ale z politick\u00fdch d\u00f4vodov nie pre n\u00e1s, a e\u0161te by som chcel \"uhryzn\u00fa\u0165\" ich oh\u013eadom licencie na ten ist\u00fd Linux, Roundcube a podobne. Odkia\u013e ber\u00fa, \u017ee \"uroben\u00edm\" rozhrania v <b>Python<\/b> a odobran\u00edm pr\u00e1v superu\u017e\u00edvate\u013ea m\u00f4\u017eu pred\u00e1va\u0165 hotov\u00fd produkt zlo\u017een\u00fd z vyvinut\u00fdch a upraven\u00fdch modulov internetovej komunity distribuovan\u00fdch pod GPL&amp;at\u010f.<\/li>\n<\/ul>\n<p>\nCh\u00e1pem, \u017ee teraz sa na m\u0148a vrhn\u00fa negat\u00edvne ohlasy s po\u017eiadavkami podrobne od\u00f4vodni\u0165 svoje subjekt\u00edvne pocity, ale chcem poveda\u0165, \u017ee tento uzol siete je z\u00e1rove\u0148 vyrovn\u00e1va\u010dom prev\u00e1dzky na 4 extern\u00e9 kan\u00e1ly do siete Internet, pri\u010dom ka\u017ed\u00fd kan\u00e1l m\u00e1 svoje \u0161pecifick\u00e9 vlastnosti. \u010eal\u0161\u00edm k\u013e\u00fa\u010dov\u00fdm bodom bola nutnos\u0165, aby jeden z viacer\u00fdch sie\u0165ov\u00fdch rozhran\u00ed fungoval v r\u00f4znych adresn\u00fdch priestoroch, a ja <b>s\u00fa pripraven\u00fd<\/b> uzna\u0165, \u017ee pou\u017e\u00edva\u0165 VLANy v\u0161ade tam, kde treba a kde netreba, ja <b>nie som pripraven\u00fd.<\/b>Existuj\u00fa zariadenia typu TP-Link TL-R480T+ \u2014 spr\u00e1vaj\u00fa sa nie ide\u00e1lne, vo v\u0161eobecnosti so svojimi nuansami. T\u00fato \u010das\u0165 na Linuxe sa podarilo rozumne nastavi\u0165 v\u010faka ofici\u00e1lnej str\u00e1nke Ubuntu. <noindex><a rel=\"nofollow\" href=\"https:\/\/help.ubuntu.ru\/wiki\/ip_balancing\">IP-Balancovanie: sp\u00e1jame nieko\u013eko internetov\u00fdch kan\u00e1lov do jedn\u00e9ho.<\/a><\/noindex>Ka\u017ed\u00fd z kan\u00e1lov m\u00f4\u017ee kedyko\u013evek \"vypadn\u00fa\u0165\", ale aj sa obnovi\u0165. Ak m\u00e1te z\u00e1ujem o skript, ktor\u00fd aktu\u00e1lne funguje (to si zasl\u00fa\u017ei samostatn\u00fd \u010dl\u00e1nok) \u2013 nap\u00ed\u0161te do koment\u00e1rov. <\/p>\n<p>Predkladan\u00e9 rie\u0161enie s\u00edce nie je unik\u00e1tne, ale kladiem ot\u00e1zku: \"Pre\u010do sa vo firme prisp\u00f4sobova\u0165 pochybnos\u0165ou produktom s vysok\u00fdmi hardv\u00e9rov\u00fdmi po\u017eiadavkami, ke\u010f je mo\u017en\u00e9 zv\u00e1\u017ei\u0165 alternat\u00edvy?\".<\/p>\n<p>Ak v RF existuje zoznam od Roskomnadzoru, na Ukrajine \u2013 aplik\u00e1cia k rozhodnutiu Rady n\u00e1rodnej bezpe\u010dnosti (napr. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.president.gov.ua\/documents\/1262018-24150\">tu<\/a><\/noindex>), tak na miestach tie\u017e ved\u00faci nespia. Napr\u00edklad sme dostali zoznam zak\u00e1zan\u00fdch webov\u00fdch str\u00e1nok, ktor\u00e9 pod\u013ea vedenia zni\u017euj\u00fa produktivitu pr\u00e1ce na pracovisku. <\/p>\n<p>Ke\u010f som sa rozpr\u00e1val s kolegami v in\u00fdch firm\u00e1ch, kde s\u00fa v\u0161etky webov\u00e9 str\u00e1nky predvolene zak\u00e1zan\u00e9 a pr\u00edstup k konkr\u00e9tnym str\u00e1nkam je povolen\u00fd iba na po\u017eiadanie nadriaden\u00e9ho, s \u00factou som sa usmial, zamyslel sa a \"pocm\u00faril sa nad probl\u00e9mom\", do\u0161lo mi, \u017ee \u017eivot je predsa len dobr\u00fd a za\u010dali sme n\u00e1\u0161 h\u013eadanie.<\/p>\n<p>S mo\u017enos\u0165ou analyticky sa pozrie\u0165 na to, \u010do sa p\u00ed\u0161e v \"knih\u00e1ch hospod\u00fd\u0148\" o filtrovan\u00ed prev\u00e1dzky, ako aj pozrie\u0165 sa, \u010do sa deje na kan\u00e1loch r\u00f4znych poskytovate\u013eov, sme si v\u0161imli nasleduj\u00face recepty (ak\u00e9ko\u013evek screenshoty s\u00fa trochu orezan\u00e9, pros\u00edm v\u00e1s o pochopenie):<\/p>\n<p>Poskytovate\u013e 1<br \/>\n \u2014 sa pr\u00edli\u0161 nezaober\u00e1 a vnucuje vlastn\u00e9 DNS servery a transparentn\u00fd proxy server. Nu\u017e, m\u00e1me pr\u00edstup tam, kam potrebujeme (ak to potrebujeme :))<\/p>\n<p>Poskytovate\u013e 2<br \/>\n \u2014 si mysl\u00ed, \u017ee o tom by sa mal postara\u0165 jeho nadraden\u00fd poskytovate\u013e, technick\u00e1 podpora nadraden\u00e9ho poskytovate\u013ea dokonca priznala, pre\u010do nem\u00f4\u017eem otvori\u0165 potrebn\u00fa nezak\u00e1zan\u00fa str\u00e1nku. Mysl\u00edm, \u017ee v\u00e1s tento obr\u00e1zok pobav\u00ed \ud83d\ude42<\/p>\n<p><img decoding=\"async\" alt=\"Iptables a filtrovanie prev\u00e1dzky od chudobn\u00fdch a leniv\u00fdch nes\u00fahlasn\u00fdch.\" src=\"\/wp-content\/uploads\/2019\/10\/ea50d22bb4ab91bfdd52ceae9ccde0e2.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAko sa uk\u00e1zalo, prev\u00e1dzaj\u00fa n\u00e1zvy zak\u00e1zan\u00fdch str\u00e1nok na IP adresy a blokuj\u00fa konkr\u00e9tne IP (neob\u0165a\u017euje ich, \u017ee na tejto IP adrese m\u00f4\u017ee by\u0165 umiestnen\u00fdch aj 20 str\u00e1nok). <\/p>\n<p>Poskytovate\u013e 3<br \/>\n \u2014 prev\u00e1dza prev\u00e1dzku tam, ale sp\u00e4\u0165 po tras\u00e1ch jej neprep\u00fa\u0161\u0165a.<\/p>\n<p>Poskytovate\u013e 4<br \/>\n \u2014 zakazuje v\u0161etky manipul\u00e1cie s paketmi v uvedenom smere.<\/p>\n<p>\u010co robi\u0165 s VPN (prehliada\u010d Opera m\u00e1 svoje z\u00e1sluhy) a doplnkami pre prehliada\u010de? Hran\u00edm na za\u010diatku so sie\u0165ov\u00fdm uzlom Mikrotik sme dokonca z\u00edskali n\u00e1ro\u010dn\u00fd recept na L7, od ktor\u00e9ho sme nesk\u00f4r museli upusti\u0165 (zak\u00e1zan\u00fdch n\u00e1zvov m\u00f4\u017ee by\u0165 aj viac, je smutn\u00e9, ke\u010f okrem svojich priamych povinnost\u00ed vo vz\u0165ahu k tras\u00e1m, na 30 r\u00f4znych v\u00fdrazov, zat\u00ed\u017eenie procesora PPC460GT dosahuje 100%).<\/p>\n<p><img decoding=\"async\" alt=\"Iptables a filtrovanie prev\u00e1dzky od chudobn\u00fdch a leniv\u00fdch nes\u00fahlasn\u00fdch.\" src=\"\/wp-content\/uploads\/2019\/10\/c71db959ded51da02ad43e8e14a4144b.jpg\" style=\"display:block;margin: 0 auto;\" \/>.<\/p>\n<p>\u010co sa uk\u00e1zalo ako jasn\u00e9:<br \/>\nDNS na 127.0.0.1 rozhodne nie je v\u0161eliek, modern\u00e9 verzie prehliada\u010dov umo\u017e\u0148uj\u00fa obch\u00e1dza\u0165 tak\u00e9to probl\u00e9my. Obmedzi\u0165 v\u0161etk\u00fdch pou\u017e\u00edvate\u013eov na zredukovan\u00e9 pr\u00e1va nie je mo\u017en\u00e9 a nem\u00f4\u017eeme zab\u00fada\u0165 na obrovsk\u00e9 mno\u017estvo alternat\u00edvnych DNS. Internet nie je statick\u00fd a okrem nov\u00fdch DNS adries zak\u00e1zan\u00e9 str\u00e1nky kupuj\u00fa nov\u00e9 adresy, menia dom\u00e9ny najvy\u0161\u0161ej \u00farovne, m\u00f4\u017eu prida\u0165 alebo odstr\u00e1ni\u0165 znak vo svojej adrese. Napriek tomu m\u00e1 pr\u00e1vo existova\u0165 nie\u010do ako:<\/p>\n<pre><code class=\"bash\">ip route add blackhole 1.2.3.4<\/code><\/pre>\n<p>\nZ\u00edskanie zoznamu IP adries zo zoznamu zak\u00e1zan\u00fdch str\u00e1nok by bolo ve\u013emi efekt\u00edvne, ale z uveden\u00fdch d\u00f4vodov sme pre\u0161li k \u00favah\u00e1m o Iptables. Existoval u\u017e \u017eiv\u00fd vyv\u00e1\u017eova\u010d na CentOS Linux verzie 7.5.1804.<\/p>\n<p>Internet u pou\u017e\u00edvate\u013ea mus\u00ed by\u0165 r\u00fdchly a prehliada\u010d by nemal \u010daka\u0165 pol min\u00faty, predpokladaj\u00fac, \u017ee t\u00e1to str\u00e1nka nie je dostupn\u00e1. Po dlhom h\u013eadan\u00ed sme dospeli k takejto modeli:<br \/>\nS\u00fabor 1 -&gt; <b>\/script\/denied_host<\/b>, zoznam zak\u00e1zan\u00fdch n\u00e1zvov:<\/p>\n<pre><code class=\"plaintext\">test.test\nblablabla.bubu\ntorrent\nporno<\/code><\/pre>\n<p>\nS\u00fabor 2 -&gt; <b>\/script\/denied_range<\/b>, zoznam zak\u00e1zan\u00fdch adresn\u00fdch priestorov a adries:<\/p>\n<pre><code class=\"plaintext\">192.168.111.0\/24\n241.242.0.0\/16<\/code><\/pre>\n<p>\nS\u00fabor-skript 3 -&gt; <b>ipt.sh<\/b>, vykon\u00e1vaj\u00faci pr\u00e1cu s iptables:<\/p>\n<pre><code class=\"bash\"># \u0441\u0447\u0438\u0442\u044b\u0432\u0430\u0435\u043c \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438\u0437 \u043f\u0435\u0440\u0435\u0447\u043d\u0435\u0439 \u0444\u0430\u0439\u043b\u043e\u0432\nHOSTS=`cat \/script\/denied_host | grep -v '^#'`\nRANGE=`cat \/script\/denied_range | grep -v '^#'`\necho \"Stopping firewall and allowing everyone...\"\n# \u0441\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u0435\u043c \u0432\u0441\u0435 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 iptables, \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u044f \u0442\u043e \u0447\u0442\u043e \u043d\u0435 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043e\nsudo iptables -F\nsudo iptables -X\nsudo iptables -t nat -F\nsudo iptables -t nat -X\nsudo iptables -t mangle -F\nsudo iptables -t mangle -X\nsudo iptables -P INPUT ACCEPT\nsudo iptables -P FORWARD ACCEPT\nsudo iptables -P OUTPUT ACCEPT\n#\u0440\u0435\u0448\u0430\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430\u0445 (\u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u043d\u0430\u0448\u0435\u0439 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b)\nsudo sh rout.sh\n# \u0446\u0438\u043a\u043b\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044f \u043a\u0430\u0436\u0434\u0443\u044e \u0441\u0442\u0440\u043e\u043a\u0443 \u0444\u0430\u0439\u043b\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0441\u0442\u0440\u043e\u043a\u0438\nfor i in $HOSTS; do\nsudo iptables -I FORWARD -m string --string $i --algo bm --from 1 --to 600 -p tcp -j REJECT --reject-with tcp-reset;\nsudo iptables -I FORWARD -m string --string $i --algo bm --from 1 --to 600 -p udp -j DROP;\ndone\n# \u0446\u0438\u043a\u043b\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044f \u043a\u0430\u0436\u0434\u0443\u044e \u0441\u0442\u0440\u043e\u043a\u0443 \u0444\u0430\u0439\u043b\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0430\u0434\u0440\u0435\u0441\u0430\nfor i in $RANGE; do\nsudo iptables -I FORWARD -p UDP -d $i -j DROP;\nsudo iptables -I FORWARD -p TCP  -d $i -j REJECT --reject-with tcp-reset;\ndone\n<\/code><\/pre>\n<p>\nPou\u017eitie sudo je sp\u00f4soben\u00e9 t\u00fdm, \u017ee m\u00e1me mal\u00fd hack na spr\u00e1vu cez WEB rozhranie, no ako uk\u00e1zala sk\u00fasenos\u0165 s pou\u017eit\u00edm tejto modely dlh\u0161ie ako rok, WEB nie je a\u017e tak\u00fd potrebn\u00fd. Po nasaden\u00ed bol z\u00e1ujem zavies\u0165 zoznam str\u00e1nok do DB a pod. Po\u010det zablokovan\u00fdch hostite\u013eov presahuje 250 + desiatku adresn\u00fdch priestorov. Naozaj je probl\u00e9m pri prechode na str\u00e1nku cez https spojenie, ako syst\u00e9mov\u00fd administr\u00e1tor m\u00e1m v\u00fdhrady k prehliada\u010dom :), ale to s\u00fa osobn\u00e9 pr\u00edpady, v\u00e4\u010d\u0161ina spusten\u00ed z d\u00f4vodu absencie pr\u00edstupu k zdroju je predsa len na na\u0161ej strane, rovnako \u00faspe\u0161ne blokujeme Opera VPN, doplnky ako friGate a telemetriu od Microsoftu.<\/p>\n<p><img decoding=\"async\" alt=\"Iptables a filtrovanie prev\u00e1dzky od chudobn\u00fdch a leniv\u00fdch nes\u00fahlasn\u00fdch.\" src=\"\/wp-content\/uploads\/2019\/10\/c08d381986d74a8000d5a77e4a34e750.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/471402\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0439 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043c\u043e\u0433\u0443\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u044a\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u043e\u043d\u0430 \u0438\u043b\u0438 \u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432. \u0417\u0430\u0447\u0435\u043c \u0438\u0437\u043e\u0431\u0440\u0435\u0442\u0430\u0442\u044c \u0432\u0435\u043b\u043e\u0441\u0438\u043f\u0435\u0434 \u0442\u043e\u0433\u0434\u0430, \u043a\u043e\u0433\u0434\u0430 \u0435\u0441\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b \u0434\u043b\u044f \u043d\u0430\u0448\u0438\u0445 \u0437\u0430\u0434\u0430\u0447, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440: Zeroshell, pfSense, ClearOS. \u0415\u0449\u0435 \u043e\u0434\u0438\u043d \u0432\u043e\u043f\u0440\u043e\u0441 \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u0443 \u043d\u0430\u0447\u0430\u043b\u044c\u0441\u0442\u0432\u0430: \u0410 \u0435\u0441\u0442\u044c \u043b\u0438 \u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0430? \u0423 \u043d\u0430\u0441 \u0431\u044b\u043b \u043e\u043f\u044b\u0442 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":29247,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38982","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0439 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043c\u043e\u0433\u0443\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u044a\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u043e\u043d\u0430 \u0438\u043b\u0438 \u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Iptables \u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0442 \u0431\u0435\u0434\u043d\u044b\u0445 \u0438 \u043b\u0435\u043d\u0438\u0432\u044b\u0445 \u0438\u043d\u0430\u043a\u043e\u043c\u044b\u0441\u043b\u044f\u0449\u0438\u0445 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0439 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043c\u043e\u0433\u0443\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u044a\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u043e\u043d\u0430 \u0438\u043b\u0438 \u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:27:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:27:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Iptables a filtrovanie prev\u00e1dzky od chudobn\u00fdch a leniv\u00fdch nez\u00e1visl\u00fdch myslite\u013eov | ProHoster","description":"Relevancia blokovania pr\u00edstupu k zak\u00e1zan\u00fdm zdrojom sa dot\u00fdka ka\u017ed\u00e9ho administr\u00e1tora, ktor\u00fd m\u00f4\u017ee by\u0165 ofici\u00e1lne obvinen\u00fd z poru\u0161enia z\u00e1kona alebo nariaden\u00ed pr\u00edslu\u0161n\u00fdch org\u00e1nov.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Iptables \u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0442 \u0431\u0435\u0434\u043d\u044b\u0445 \u0438 \u043b\u0435\u043d\u0438\u0432\u044b\u0445 \u0438\u043d\u0430\u043a\u043e\u043c\u044b\u0441\u043b\u044f\u0449\u0438\u0445 | ProHoster","og:description":"\u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0438\u0439 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043c\u043e\u0433\u0443\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0435\u0434\u044a\u044f\u0432\u0438\u0442\u044c \u043d\u0435\u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u043e\u043d\u0430 \u0438\u043b\u0438 \u0440\u0430\u0441\u043f\u043e\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/iptables-i-filtratsiya-trafika-ot-bednyh-i-lenivyh-inakomyslyashhih","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:27:11+00:00","article:modified_time":"2019-10-31T19:27:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38982","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 00:15:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:59:27","updated":"2026-01-24 00:15:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/38982","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=38982"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/38982\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/29247"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=38982"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=38982"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=38982"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}