* recent module --hitcount problem
@ 2005-03-07 14:32 Sudheer Divakaran
0 siblings, 0 replies; 2+ messages in thread
From: Sudheer Divakaran @ 2005-03-07 14:32 UTC (permalink / raw)
To: netfilter
Hi,
Is there anything wrong with these commands?. It seems that the recent
module (0.3.1) is not considering the '--hitcount 10' attribute if the
machine is running for a long time (in the long run). But when I tested
these rules from another machine, it worked properly. But on the live
server, iptables blocks hosts if they attempted to access the SMTP port
within 60 seconds for a second time.
$IPT -A SMTP_HAMMER -j LOG --log-level debug
$IPT -A SMTP_HAMMER -m recent --set --name hammer -j DROP
$IPT -A CHECK_SMTP -m recent --rcheck --seconds 480 --name hammer
-j DROP
$IPT -A CHECK_SMTP -m recent --rcheck --seconds 60 --hitcount
10 -j SMTP_HAMMER
$IPT -A CHECK_SMTP -m recent --update
-j ACCEPT
$IPT -A CHECK_SMTP -m recent --set
-j ACCEPT
$IPT -A INPUT -i $WAN_IFACE -p tcp --dport 25 -m state --state NEW
-j CHECK_SMTP
--
Thanks
Sudheer
^ permalink raw reply [flat|nested] 2+ messages in thread
* recent module --hitcount problem
@ 2006-02-13 23:49 william
0 siblings, 0 replies; 2+ messages in thread
From: william @ 2006-02-13 23:49 UTC (permalink / raw)
To: netfilter@lists.netfilter.org
> Hi,
>
> Is there anything wrong with these commands?. It seems that the recent
> module (0.3.1) is not considering the '--hitcount 10' attribute if the
> machine is running for a long time (in the long run). But when I tested
> these rules from another machine, it worked properly. But on the live
> server, iptables blocks hosts if they attempted to access the SMTP port
> within 60 seconds for a second time.
>
> $IPT -A SMTP_HAMMER -j LOG --log-level debug
> $IPT -A SMTP_HAMMER -m recent --set --name hammer -j DROP
>
> $IPT -A CHECK_SMTP -m recent --rcheck --seconds 480 --name hammer
> -j DROP
> $IPT -A CHECK_SMTP -m recent --rcheck --seconds 60 --hitcount
> 10 -j SMTP_HAMMER
> $IPT -A CHECK_SMTP -m recent --update
> -j ACCEPT
> $IPT -A CHECK_SMTP -m recent --set
> -j ACCEPT
>
>
> $IPT -A INPUT -i $WAN_IFACE -p tcp --dport 25 -m state --state NEW
> -j CHECK_SMTP
>
>
> --
>
> Thanks
> Sudheer
The recent module is broken. For more details see:
http://blog.blackdown.de/2005/05/09/fixing-the-ipt_recent-netfilter-module/
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2006-02-13 23:49 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2005-03-07 14:32 recent module --hitcount problem Sudheer Divakaran
-- strict thread matches above, loose matches on Subject: below --
2006-02-13 23:49 william
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.