Help!!! iptables hashlimit

Help!!! iptables hashlimit

[ha do]

hi all

i just setup the hashlimit for SIP REGISTER on iptables and the rule is:
-A  INPUT -p udp -i eth0 --dport 5060 -m hashlimit --hashlimit 1/minute  
--hashlimit-burst 2 --hashlimit-mode srcip,srcport  --hashlimit-name  "cucku" -m 
string --string "REGISTER sip:" --algo bm --to 80 -j ACCEPT

so   from my understand the IPTABLES will let 2 REGSITER packets per minute
so when i use the xlite to  send the RESGISTER message , the first REGISTER 
packet is accepted but  the seconds REGISTER packet is blocked by iptables

[root@centos  ~]# uname -a
Linux centos 2.6.18-128.el5PAE  #1 SMP Wed Jan 21 11:19:46  EST 2009 i686 i686 
i386 GNU/Linux

i want the iptables just to  accept 2 REGISTER packets per minute on per IP 
address:port
please  help

Thank  you


      

Re: Help!!! iptables hashlimit

[Curby]

On Wed, Jul 14, 2010 at 2:03 AM, ha do <haloha201@yahoo.com> wrote:
> i just setup the hashlimit for SIP REGISTER on iptables and the rule is:
> -A  INPUT -p udp -i eth0 --dport 5060 -m hashlimit --hashlimit 1/minute
> --hashlimit-burst 2 --hashlimit-mode srcip,srcport  --hashlimit-name  "cucku" -m
> string --string "REGISTER sip:" --algo bm --to 80 -j ACCEPT

> i want the iptables just to  accept 2 REGISTER packets per minute on per IP
> address:port

There might be other issues, but you need hashlimit 2/minute to accept
2 packets per minute.  Having a burst of 2 by itself is not
sufficient.

Sometimes, due to network latency or other timing issues, you need to
be even more accepting.  For example, I've found that accepting
"well-behaved" pings requires a minimum hashlimit of 61/min with burst
of 2.  When I lower either setting, iptables starts dropping the
occasional ping packet.

--Mike

Re: Help!!! iptables hashlimit

[ha do]

Hi Curby

thank you for your reply
SIP server and sip endpoint is in the same LAN so what do you think about 
network lantency

do i test with this:
-A INPUT -p udp -i eth0 --dport 5060 -m hashlimit --hashlimit 70/minute 
--hashlimit-burst 10  --hashlimit-mode srcip,srcport --hashlimit-name "cucku" -m 
string --string "REGISTER sip:" --algo bm --to 80 -j ACCEPT


the iptables still drop packet

i checked again the man page and see : 
[--hashlimit-htable-gcinterval] interval between garbage collection runs

could you guide me how to use it

Thank you
Ha`

----- Original Message ----
From: Curby <curby@cur.by>
To: ha do <haloha201@yahoo.com>
Cc: netfilter@vger.kernel.org
Sent: Wed, July 14, 2010 3:39:51 PM
Subject: Re: Help!!! iptables hashlimit

On Wed, Jul 14, 2010 at 2:03 AM, ha do <haloha201@yahoo.com> wrote:
> i just setup the hashlimit for SIP REGISTER on iptables and the rule is:
> -A  INPUT -p udp -i eth0 --dport 5060 -m hashlimit --hashlimit 1/minute
> --hashlimit-burst 2 --hashlimit-mode srcip,srcport  --hashlimit-name  "cucku" 
>-m
> string --string "REGISTER sip:" --algo bm --to 80 -j ACCEPT

> i want the iptables just to  accept 2 REGISTER packets per minute on per IP
> address:port

There might be other issues, but you need hashlimit 2/minute to accept
2 packets per minute.  Having a burst of 2 by itself is not
sufficient.

Sometimes, due to network latency or other timing issues, you need to
be even more accepting.  For example, I've found that accepting
"well-behaved" pings requires a minimum hashlimit of 61/min with burst
of 2.  When I lower either setting, iptables starts dropping the
occasional ping packet.

--Mike



      

Re: Help!!! iptables hashlimit

[Jan Engelhardt]

On Wednesday 2010-07-14 10:03, ha do wrote:

>hi all
>
>i just setup the hashlimit for SIP REGISTER on iptables and the rule is:
>-A  INPUT -p udp -i eth0 --dport 5060 -m hashlimit --hashlimit 1/minute  
>--hashlimit-burst 2 --hashlimit-mode srcip,srcport  --hashlimit-name  "cucku" -m 
>string --string "REGISTER sip:" --algo bm --to 80 -j ACCEPT
>
>so   from my understand the IPTABLES will let 2 REGSITER packets per minute
>so when i use the xlite to  send the RESGISTER message , the first REGISTER 
>packet is accepted but  the seconds REGISTER packet is blocked by iptables

Order matters! The packet is counted, even if it does not match the 
string.