hashtable configuration issue

hashtable configuration issue

[J. Bakshi]

Dear Marek and all,

First of all my thanks to all of you to make me familiar with the great
hashtable module. According to Marek's  suggestion I have a ruleset with
synflood protection along with IP blacklist

````````````````````
# default policy drop ##

# accept related , establish ##


# Set blacklist #
echo "blacklist initialization"
iptables -A INPUT -m recent --name blacklist --rcheck --seconds
$BLACKLIST_INTERVAL  -j DROP

## some other anti nmap rule##

##syncflood protection with IP blacklist ##

iptables -N syn-flood
iptables -A INPUT -i $IFACE -p tcp --syn -j syn-flood
iptables -A INPUT -p tcp --syn  -m hashlimit \
--hashlimit 1/sec --hashlimit-burst 4 --hashlimit-htable-expire 300000 \
--hashlimit-mode srcip --hashlimit-name testlimit -j RETURN

# Drop bad IP and put themin blacklist ############
iptables -A syn-flood -m recent --name blacklist --set -j DROP
iptables -A INPUT -j syn-flood

## my incoming and outgoing rules ##

## DROP other ##
```````````````````````````````````

But this time firewall totally blocks all incoming connection. If I
change the RETURN (above) to ACCEPT then then firewall accept *all*
incoming even the ports are blocked in the firewall !!!   I  am very
confused. Could any one enlighten me ? I missed something or
mis-configuration ?

Re: [solved] hashtable configuration issue

[J. Bakshi]

J. Bakshi wrote:

got it :-)


iptables -N syn-flood
iptables -A INPUT -i $IFACE -p tcp --syn -j syn-flood
iptables -A syn-flood -p tcp --syn  -m hashlimit \
--hashlimit 1/sec --hashlimit-burst 4 --hashlimit-htable-expire 300000 \
--hashlimit-mode srcip --hashlimit-name testlimit -j RETURN
# Drop IP bad IP and put then in blacklist
iptables -A syn-flood -m recent --name blacklist --set -j DROP
iptables -A INPUT -j syn-flood




> Dear Marek and all,
>
> First of all my thanks to all of you to make me familiar with the great
> hashtable module. According to Marek's  suggestion I have a ruleset with
> synflood protection along with IP blacklist
>
> ````````````````````
> # default policy drop ##
>
> # accept related , establish ##
>
>
> # Set blacklist #
> echo "blacklist initialization"
> iptables -A INPUT -m recent --name blacklist --rcheck --seconds
> $BLACKLIST_INTERVAL  -j DROP
>
> ## some other anti nmap rule##
>
> ##syncflood protection with IP blacklist ##
>
> iptables -N syn-flood
> iptables -A INPUT -i $IFACE -p tcp --syn -j syn-flood
> iptables -A INPUT -p tcp --syn  -m hashlimit \
> --hashlimit 1/sec --hashlimit-burst 4 --hashlimit-htable-expire 300000 \
> --hashlimit-mode srcip --hashlimit-name testlimit -j RETURN
>
> # Drop bad IP and put themin blacklist ############
> iptables -A syn-flood -m recent --name blacklist --set -j DROP
> iptables -A INPUT -j syn-flood
>
> ## my incoming and outgoing rules ##
>
> ## DROP other ##
> ```````````````````````````````````
>
> But this time firewall totally blocks all incoming connection. If I
> change the RETURN (above) to ACCEPT then then firewall accept *all*
> incoming even the ports are blocked in the firewall !!!   I  am very
> confused. Could any one enlighten me ? I missed something or
> mis-configuration ?
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
>