Re: -m recent

[Stephen Frost <sfrost@snowman.net>]

[-- Attachment #1: Type: text/plain, Size: 998 bytes --]

* uniplex (uniplex@maximum-linux.net) wrote:
> Has anyone here had any luck with this?

It works for me and I use it, though, well, I wrote it too, so.. :)

> It's logging the ip and ttl etc etc in the file it's supposed to, but 
> the --update -j DROP rule I'm using doesn't seem to have any effect.
> 
> Here's a snip of rules from my script that I've been using to test with. 
> I've put them in the same order as they appear in the script. It's not 
> the entire script(of coarse) and I'm matching to icmp packets just to 
> test with.
> 
> iptables -A INPUT -i eth0 -p all -m recent --name icmps --update -j DROP
> 
> iptables -N icmps
> iptables -A INPUT -i eth0 -p icmp -j icmps
> iptables -A icmps -m recent --name icmps --set -j DROP
> iptables -A icmps -j DROP

This looks good to me..  Can you tell me what version of ipt_recent
you're using?  An old version had a bug where the --name only worked
when it was the last option, that may be the problem.

	Stephen

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]