nft add table ip cve_2026_98432
nft add chain ip cve_2026_98432 pre '{ type filter hook prerouting priority -300; }'
nft add rule ip cve_2026_98432 pre meta l4proto tcp ip hdrlength gt 5 counter drop
2,535 karma · joined October 26, 2012
nft add table ip cve_2026_98432
nft add chain ip cve_2026_98432 pre '{ type filter hook prerouting priority -300; }'
nft add rule ip cve_2026_98432 pre meta l4proto tcp ip hdrlength gt 5 counter drop
Use this firewall rule and you are fine - it blocks the tcp options negoation - and things remain working of course: ` nft add table ip cve_2026_98432 nft add chain ip cve_2026_98432 pre '{ type filter hook prerouting priority -300; }' nft add rule ip cve_2026_98432 pre meta l4proto tcp ip hdrlength gt 5 counter drop `
What you describe sound extremely expensive, even from a future perspective. It doesn't make any sense. And for larger businesses who can afford things, we already have quasi automated date-centers from AWS and others.
One could simply put a Node.js server directly on the line. And then it is crystal clear who calls the business logic. I mean, there are reasons why we use Nginx in front of it. Distribution, filtering, rate limiting, etc..
BTW, the cgi-bin competitor back in the days was JavaScript too with the Netscape Communication/Enterprise Server that supported server-side dynamic JavaScript in 1997! Funny enough. :-)
I mean it somehow still feels cheep, if I watch the prices for new hardware.
But it took me days to create this upper mentioned system from all the different sellers and different sources on eBay. There is no "cheap" one-click solution with included guarantee anymore.
Back in the days, when I made websites or home pages for clients, my first question was: "What's your message you want to tell with your website?" Sometimes the client couldn't answer this, because he simply wanted a website for the sake of having a website. But a website without a message is meaningless more or less.