[00:41] LeMike: hah, figures :) still, now you know a new tool :D not all bad === TxRaspPi is now known as TxRaspPI [19:00] Hi.. I am trying to find some documentation on UFW as I am a little new to it. I am trying to understand what this line means: -A ufw-http-logdrop -m limit --limit 5/min --limit-burst 10 -j LOG --log-prefix "[UFW HTTP DROP] " [19:01] Specifically what the --limit and --limit-burst does. I understand --limit is limiting something, but the 5/min... what is that doing along with the limit burst? [19:21] xrandr_mac: this is for rate limiting by ip address. see iptables-extensions(8) and search for: ^ limit [19:21] Ok thanks [19:26] That cleared it up [19:26] * xrandr_mac offers tomreyn a beer for his troubles :) [19:29] no troubles here ;) thanks, though [19:30] Was wondering why I kept being locked out of my website lol [21:07] xrandr_mac: it's intended to be used with things like SSH or VPNs [21:09] JanC, wanted to prevent DDOS attacks [21:11] you can probably do that with a custom iptables rule similar to the one created by UFW, but less trigger-happy :) [21:12] or use nftables if you're on the cutting edge ;) [21:12] isn't nftables replaced yet? ;) [21:13] s/replaced/superseded/ [21:13] no [21:13] ifw was superseeded by ipchanges, which was superseeded by iptables, which as superseeded by nftables [21:13] s/ifw/ipfw/ [21:14] and not ipchanges, ipchains [21:15] interesting how my fingers just write on automatically [21:21] lol [21:21] I think for now I am going to just disable that rule... [21:24] RoyK: there is now also something called bpfilter which is based on eBPF, but it's still a WiP :) [21:28] oh - didn't know that [21:38] JanC: seems rather cutting edge - probably take a wee while to stabilise [21:41] :) [21:47] anyone have any idea why a Standard Lamp stack containing MySQL instead of MariaDB on Ubuntu Server 18.01.1 LTS would be lagging when trying to view the page? [21:54] nvm google-fu found the answer, I'll be migrating this to MariaDB [22:57] RoyK: very cutting edge indeed - I dont think they have any actual functionality yet. [22:58] basically an experiment at this stage. [22:59] also nftables might move over to the same infra IIRC. today nftables uses something similar to but not BPF [23:12] trippeh_: I don't know BPF, but I read nftables uses a miniature vm with a micro-OS [23:12] not even an OS, really [23:12] separate instruction set etc [23:13] yes, like BPF. [23:14] perhaps nftables will disappear like upstart, then… [23:15] or just become another frontend [23:35] BPF certainly looks promising, though [23:37] https://cilium.io/blog/2018/04/17/why-is-the-kernel-community-replacing-iptables/ The most recent development in the evolution of BPF is an exciting proposal to completely replace the kernel part of iptables with BPF in a way that is completely transparent to the user, i.e. existing iptables client binaries and libraries will continue to work. [23:40] I've never worked with systems large enough to hit the bottleneck of iptables, though [23:41] but then - I don't have 20k Kubernetes services [23:45] I've experimented a bit with BPF - but not the bpfilter, as that is still not very useful [23:45] XDP is fun [23:47] the tracing stuff too [23:48] so - perhaps nftables is just a pit stop? [23:49] I don't really see the difference - I don't know the stuff under the hood [23:49] between nftables and bpfilter, that is [23:49] I'd expect nftables to just become another frontend to bpfilter, with nicer syntax than iptables. [23:50] if bpfilter pans out that is. that we do not know. [23:50] but what about nftables? it too uses a completely different backend than iptables [23:50] althouth nftables have shown the bytecode approach to be viable. [23:52] BPF - is that how freebsd has been doing firewalling the latest years, hence the "berkley" name? [23:52] nftables would be changed to emit BPF. like iptables would be [23:53] BPF var originally a filter for sockets, for tcpdump and the like. not really a firewall thing. [23:53] the BPF in linux is significantly extended [23:54] just wondered - uio.no built this service for sensitive data some years back, mainly for universities and colleges, but also others, in norway, and I know they used freebsd for the firewall, at least 5 years back [23:55] the rest is mostly linux [23:55] you're thinking about pf probably [23:55] possibly [23:55] I just never saw the big deal with pf compared to iptables [23:56] pf has nothing to do with BPF [23:57] ok [23:57] btw, any idea why some would prefer pf to iptables? [23:57] many hate the iptables syntax. I dont mind it either [23:57] I'm quite used to iptables [23:58] works [23:59] that obviously doesn't mean it's optimal