Discuss mailing list

["oVPN.to Support" <support AT ovpn.to>]

new rules to add:

iptables --insert INPUT -p udp --dport 53 -m string --from 30 --to 58
--algo bm --hex-string '|02747a047665363003636f6d0000010001|' -j DROP -m
comment --comment "ve60.com"
iptables --insert INPUT -p udp --dport 53 -m string --from 30 --to 58
--algo bm --hex-string '|037777770339617103636f6d0000010001|' -j DROP -m
comment --comment "9aq.com"
iptables --insert INPUT -p udp --dport 53 -m string --from 30 --to 58
--algo bm --hex-string '|03777777063836306b616e03636f6d0000010001|' -j
DROP -m comment --comment "860kan.com"
iptables --insert INPUT -p udp --dport 53 -m string --from 30 --to 58
--algo bm --hex-string '|03777777066e793233343503636f6d0000010001|' -j
DROP -m comment --comment "ny2345.com"
iptables --insert INPUT -p udp --dport 53 -m string --from 30 --to 58
--algo bm --hex-string '|03646c7106686a6438303003636f6d0000010001|' -j
DROP -m comment --comment "hjd800.com"
iptables --insert INPUT -p udp --dport 53 -m string --from 30 --to 58
--algo bm --hex-string '|0377777706786171736a6303636f6d0000010001|' -j
DROP -m comment --comment "xaqsjc.com"
iptables --insert INPUT -p udp --dport 53 -m string --from 30 --to 58
--algo bm --hex-string
'|096170692d746f6b656e07706f70766f746502686b000001|' -j DROP -m comment
--comment "popvote.hk"
iptables --insert INPUT -p udp --dport 53 -m string --from 30 --to 58
--algo bm --hex-string '|74047a6f6e6702636f0275610000ff00010000292328|'
-j DROP -m comment --comment "bangtest.zong.co.ua"

oVPN.to Support:
> find our full script here:
> https://paste.d0wn.biz/53905be89a.txt
> 
> do as root:
> paste into "iptables.sh"
> do "chmod +x iptables.sh"
> run with "./iptables.sh"
> 
> maybe openvz has problems with this rules, did not try.
> with kvm and dedicateds working fine.
> 
> but, our dns is running dedicated (inside kvm), nothing more than DNS
> inside this machine.
> you should merge it into your iptables if you use any.
> need help or more questions? join irc.ovpn.to/#ovpn.to
> 
> btw, most of you'll still see incoming traffic with tcpdump, unless
> you are not filtering at firewall/gateway-level with INPUT-rules,
> but requests dont reach your DNS and you are not sending requests to
> upstreams and no answers back.
> 
> i'll join freenode/#opennic later.
> 
> peace!
> MrNice
> oVPN.to
>