Éric Leblond

Not sure if this is the best, but I use nftables and this article helped me setup port knocking on a debian server: https://home.regit.org/2017/07/nftables-port-knocking/ Then I added a tripwire feature to make it less likely that a random port traversal would be successful. Here's a snippet of my nftables.conf: define KNOCK_PORT1 = 20000 define KNOCK_PORT2 = 30000 define KNOCK_PORT3 = 10000 define TRIPWIRE_PORT1 = 15000 define TRIPWIRE_PORT2 = 25000 table inet filter { . . set allowed_ssh { type ipv4_addr flags timeout elements = { $HOME_IP, $OTHER_SERVER_IP } } # track port knocking set knock1 { type ipv4_addr timeout 5s } set knock2 { type ipv4_addr timeout 5s } set banned { type ipv4_addr timeout 1m } # handle port knocking chain raw { type filter hook prerouting priority raw; policy accept; ip saddr @banned tcp dport { $KNOCK_PORT1, $KNOCK_PORT2, $KNOCK_PORT3} log prefix "nft banned: " drop tcp dport $KNOCK_PORT1 set add ip saddr @knock1 log prefix "nft knock1: " drop ip saddr @knock1 tcp dport $TRIPWIRE_PORT1 set add ip saddr @banned log prefix "nft tripwire1: " drop ip saddr @knock1 tcp dport $KNOCK_PORT2 set add ip saddr…

Yep, and while I'm too lazy to dig into detailed kernel histories, that's been in there for at least 9 years now: https://home.regit.org/2011/04/ipv6-privacy/ Short version: echo "2">/proc/sys/net/ipv6/conf/eth0/use_tempaddr turns on privacy extensions on eth0, and makes them the preferred addresses.

I had a raspberry pi on my network via ethernet and saw it had accumulated a ton of IPv6 addresses. Ended up just disabling privacy extensions on it. If your machines reset their network connection (ie wireless reconnects) then they'll flush their IPv6 privacy addresses. Your machines might just have a long timeout before they use a new privacy address. You can find more info here: https://home.regit.org/2011/04/ipv6-privacy/

Yeah.. true.. still prefer the config file format[1] nftables brings along though. [1] https://home.regit.org/netfilter-en/nftables-quick-howto/

I'm pretty sure you can do this sort of load balancing on Linux without having to install any extra software, at the IP level, with the "ip rule" and "iptables" commands. EDIT: Yep: https://home.regit.org/netfilter-en/links-load-balancing/

BTW, here's some other cheats i've bookmarked. With 100+ commands, different teams' workflows are significantly different. http://ktown.kde.org/~zrusin/git/git-cheat-sheet.svg http://www.spheredev.org/wiki/Git_for_the_lazy http://jan-krueger.net/development/git-cheat-sheet-take-two http://www.gnome.org/~federico/misc/git-cheat-sheet.txt http://home.regit.org/?page_id=32 others?

Yes, see https://home.regit.org/2011/04/ipv6-privacy/