Re: iptables problem with rules

[Antony Stone <Antony@Soft-Solutions.co.uk>]

On Friday 28 June 2002 7:04 pm, ganesh kumar godavari wrote:

> hello group,

>   i want to limit
>   the # of packets based on the type of protocol used
>
>   i have used iptables rules like
>
> #Syn-flood protection:
>   iptables -A FORWARD -s a.b.c.d -p tcp --syn -m
>   limit --limit 1/s -j ACCEPT
>
> the rule doesn't help to stop the packets
>
> i tried the following rule it helps me to stop the ping flood
> attack
>
>   iptables -A INPUT  -s 128.198.60.195 -p icmp
>   --icmp-type echo-request -m limit --limit 1/s -j
>   ACCEPT
>   iptables -A INPUT -p icmp --icmp-type echo-request -j DROP

I am confused about whether you are trying to stop packets coming in to the 
machine running netfilter (ie you are putting the rules in the INPUT chain) 
or whether you are trying to stop packets going through the netfilter machine 
to another host (ie you are putting the rules in the FORWARD chain).

Please can you clarify your network setup ?

 

Antony.