2026-01-23 05:54 UTC
@markmcb@mas.to I do something very similar to what you do, a bit more complicated. Anyone requesting .php or a number of other paths gets a 403 and firewalled via fail2ban, no matter what the HTTP version (I don't have WP or any PHP on my site, no one should be asking for /admin, etc etc etc). And then for HTTP 1.x I allow requests for atom.xml and rss.xml; allow a list of bots I approve of; serve 418 to the rest, with a little teapot emoji as the body.
Replies (1)
-
@adingbatponder@fosstodon.org 2026-01-23 08:36
@stephen@microbe.vital.org.nz @markmcb@mas.to Very interesting firewall settings. Thanks for sharing them. Question into the void: is there a “menu-style” FOSS #firewall setup for #NixOS —prebuilt profiles with different strictness levels one can apply and test? I’m running #Suricata #IDS, but I don’t have a systematic way to validate #firewallpolicy beyond “tweak until it works.” I’d love a repeatable approach to reach a good protection baseline with minimal site access #breakage .