Do not block IP, but proccess the rule and return 403 ?

elialum · **Posted:** Tue Nov 08, 2011 3:15 am

Hi,

When mod_security is triggered, he passes the IP of the attacker to IPTABLES and the IP is blocked (after about 10 retries..).
Is there anyway *NOT* to block the ip, and just to return 403 Forbidden screen ?

For example, if the attacker is from 192.168.0.0/24 Network, never block the IP, but still proccess the rules.

Any ideas?

Thanks,
Eli Alum.

Highland · **Joined:** Mon Apr 10, 2006 12:55 pm **Posts:** 656

If you whitelist the IP that's exactly what will happen. OSSEC doesn't block whitelist IPs

mikeshinn · **Posted:** Tue Nov 08, 2011 12:46 pm

Exactly, just add the IPs/Networks to the whitelist in ASL and you are all set.

Do not block IP, but proccess the rule and return 403 ?

Who is online