Re: match limit with inverse [!]

["Graham - Reg.CA" <graham@reg.ca>]

Thanks!  The new workaround is hardly as convenient, but we managed to work
out a workable set of rules in the end.  It would have saved us a lot of
confusion if the documentation (man iptables) of  didn't imply that the "!"
rule worked.

Still it would be nice to see the proper inverse work for a later release -
the "inverse" rule is hardly intuitive.

----- Original Message -----
From: "Cedric Blancher" <blancher@cartel-securite.fr>
To: "Jerome de Vivie" <jerome.de-vivie@wanadoo.fr>
Cc: "Graham- Reg.CA" <graham@reg.ca>; <netfilter-devel@lists.netfilter.org>
Sent: Saturday, November 23, 2002 9:53 AM
Subject: Re: match limit with inverse [!]


> Le sam 23/11/2002 à 19:24, Jerome de Vivie a écrit :
> > Your out of luck. The patch hasn't been applied because it a kernel
> > header and could disturb older versions of netfilter. The patch is under
> > http://perso.wanadoo.fr/jerome.de-vivie/ipt/
>
> However, we can emulate limit inverse with a user chain. Suppose you
> want to log and drop ICMPs that are over the 1/S limit :
>
> iptables -N inv_limit
> iptables -A FORWARD -p icmp -j inv_limit
> iptables -A inv_limit -m limit --limit 1/s -j RETURN \
> --log-prefix "Over limit ICMP "
> iptables -A inv_limit -j LOG
> iptables -A inv_limit -j DROP
> [...]
>
> That's only a workaround...
>
> --
> Cédric Blancher  <blancher@cartel-securite.fr>
> IT systems and networks security expert  - Cartel Sécurité
> Phone : +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
> PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE