Another question, if you don't mind. When I do iptables -S, the 2 new rules display as
-A INPUT -s 76.126.27.xxx/32 ! -i lo -j DROP
-A INPUT -s 192.168.1.1/32 ! -i lo -j DROP
I am wondering about the /32. My LAN is the default 192.168.1.xxx. Isn't that a /24?
Finally, the rules seem to have reduced, but not eliminated, the "own address" warning. Do I need to add something for IPv6?
First a little story...
A child learns to pick up all his toys off the floor and put then away neatly.
One day he is playing on the table, and his mother asks him to put his toys away. He pauses, then knocks all the toys off the table, and
before mother can say anything starts to pick them up ...
Was he being bad? No he had just converted the problem of cleaning up the toys from the table to one he knew how to do!
So when we asked iptables to do a rule with just one ip address, it did not know how to do that directly and converted the request to one it knew how to solve. It already knows how to handle a network by matching just the first few bits of the address. For you, the /24 says the first 24 bits are all that must be equal for it to be on your network. Now there are 32 bits in an Ipv4 address, so if you make the network be /32 it will check all 32 bits and get just one IP address. Maybe a little convoluted, but it works. For Ipv6 there are 128 bits in the address, so it would have used /128 to select only one Ipv6 address. Now if you were to change it to a /24 that would be all the addresses in your network, and you would lock yourself out until a reboot (see below)
I don't like "seem to have reduced", I want to know exactly which is why to output of the iptables command. The -nvL part says to List the rules in verbose mode (with usage stats) and numerical address (don't pretty up to output, I prefer exact numbers). The --lin is short for option to get the line numbers of the rules and yes it takes two dashes.
I usually do that type of listing, because the shortest way to delete a rule uses the line/rule number. For example "iptables -D INPUT 3" would delete rule number 3, but be careful as the rules renumber after each command so in this example rule #4 would become rule #3 right after the deletion.
I asked for the ifconfig output because I wanted to check that we had all the Ipv4 addresses covered before tackling the Ipv6 question.
As to John's concern about locking yourself out of the router, that is why we are doing this in firewall-start.sh (note the .sh ending) so that should we make a mistake, a reboot of the router will not execute the .sh file, and we are back up.
