From: Jeff <Jeff.Meyers@gmx.net>
To: netfilter@vger.kernel.org
Subject: Accept clients that were seen at least twice only
Date: Wed, 26 Aug 2015 14:21:38 +0200 [thread overview]
Message-ID: <55DDAF52.3090507@gmx.net> (raw)
Hello everybody,
I am looking for a way to accept traffic from clients only if they were
seen at least twice. This shall be part of a firewall concept which
protects the target from random floods where source IPs are usually only
seen once since they are random.
I cannot use the --state ESTABLISHED here because this requires a
complete handshake (for TCP). I'm okay with the first packet not
matching this rule as long as the 2nd one does. I'm looking forward to
reading your ideas!
Best,
Jeff
next reply other threads:[~2015-08-26 12:21 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-08-26 12:21 Jeff [this message]
2015-08-26 12:46 ` Accept clients that were seen at least twice only André Paulsberg-Csibi
2015-08-26 12:51 ` Jeff
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=55DDAF52.3090507@gmx.net \
--to=jeff.meyers@gmx.net \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.