My proxmox attacking a NFS Server? SPAM Warning!

[Amori]

Hello,

Today I got a warning that my proxmox attacking a NFS server*One of my clients running bruteforce on his NFS* looks like this:

1. Nov 29 06:25:21 SRC=xxx.xxx.xxx.xx DST=xxx.xx.xx.xxSPT=978 DPT=2049

Im using IP forwarding, one IP for all my clients. It make it hard to me listing out which VM causing that bruteforce attack.

I need help solving this issue, maybe there is a code to block the outgoing traffic to that IP via firewall or iptables?

Thank for your help!

 

[Amori]

Please someone help.

Is there any code to block outgoing traffic for a specific IP address? in this case I can just block the IP and no one of my clients can attack the IP?

 

[da5id]

iptables -A OUTPUT -d x.x.x.x -j DROP

Don't forget to save your rules.