iptables script

[cm0s 118]

cheerz

[zhang888 1065]

Remove:

iptables -A INPUT -s 10.0.0.0/8 -j DROP

 

Air's infrastructure relies on this address space (DNS responses for example).

Many people have their LANs on it too.

 

The major section, let's just call it malformed packets, is imho redundant - the traffic never hits

your network directly when you are connected to the VPN, it reaches Air's servers first where

similar rules already apply, in any case malformed packets will never reach you as first SYN.

It will reach Air's server and stop there. Try to send random SYN with any flags to Air's servers

and open tcpdump at your end, none of those packets will reach you.

Same applies for most of these rules, like bruteforce protection. Traffic will never reach your ports,

unless you forward them in the dashboard. And ports below <1024 you can't forward, so 443 makes no sense.

 

Your script will have a better application on servers rather than on clients, imho.

[cm0s 118]

cheerz