How to block Smoothwall firewall hits from China and Korea
examining your firewall logs, you will probably notice that a large
percentage of firewall hits orginate from Chinese or Korean IP
These constant probes of your defenses should be a reminder that you
should never leave any unnecessary ports open to the world. While
Smoothwall will not accept these hits unless the target port is open,
they fill up the firewall logs and are a nuisance. Fortunately, they can be easily blocked.
could manually enter all the Chinese and/or Korean IP address ranges into the IP Block web
manager page of your Smoothwall, but there is a much easier way.
You can modify the contents of the /var/smoothwall/ipblock/config
file to include the Chinese and/or Korean IP addresses using a text editor on a Linux
desktop machine. The contents of the config file looks like this:
Make a backup of your existing /var/smoothwall/ipblock/config file before uploading the new file. Also,
examine the new config file before uploading it to your Smoothwall to
verify that there is only one IP range per line and each line has the
proper text after the IP range. Also, there should not be any
blank lines, not even at the bottom of the file.
Upload the new file to your Smoothwall, then either reboot or run the following commands from the terminal:
For IP address ranges of other countries, check out http://www.countryipblocks.net/
Page updated July 24, 2011