Iptables --update recent module
up vote
0
down vote
favorite
This is what I have (in short):
--update --seconds 60 --hitcount 10 -j DROP
Does it mean that the rule will trigger if this hit count is 10 only? But what if the hit count is 9 or 11 will it not work will it? That's exactly what's going on in my case. The hit counts are 35, 40, 53, etc. and the rule does not work. Could anybody advise please, how do I make it work when this darn hit count is anything more than 10?
The entire thing looks like this:
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 -j DROP
P.S. Does this "--state NEW" mean a new connection form the same IP address or a new connection from another (new) IP address? It's confusing.
iptables
edited Nov 21 at 23:10
Rui F Ribeiro
38.2k1475125
asked Nov 20 at 11:50
Dennis
11
New contributor
Dennis is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
up vote
0
down vote
favorite
This is what I have (in short):
--update --seconds 60 --hitcount 10 -j DROP
Does it mean that the rule will trigger if this hit count is 10 only? But what if the hit count is 9 or 11 will it not work will it? That's exactly what's going on in my case. The hit counts are 35, 40, 53, etc. and the rule does not work. Could anybody advise please, how do I make it work when this darn hit count is anything more than 10?
The entire thing looks like this:
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 -j DROP
P.S. Does this "--state NEW" mean a new connection form the same IP address or a new connection from another (new) IP address? It's confusing.
iptables
edited Nov 21 at 23:10
Rui F Ribeiro
38.2k1475125
asked Nov 20 at 11:50
Dennis
11
New contributor
Dennis is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
This will only match if there are 10 (or more, explicitly stated in the manpage) hits within the last 60 seconds. Perhaps the counter you're seeing is including hits from more that 60 seconds ago?
– wurtel
Nov 20 at 12:04
Thank you for your comment. It's not the counter, it's live in my logs. The time is specified exactly in hours, minutes, and seconds (+ year, month, and day). It goes right through as if this rule does not exist at all...
– Dennis
Nov 20 at 12:11
Does it perhaps have anything to do with --limit-burst? Isn't it missing here is it?
– Dennis
Nov 20 at 12:30
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
This is what I have (in short):
--update --seconds 60 --hitcount 10 -j DROP
Does it mean that the rule will trigger if this hit count is 10 only? But what if the hit count is 9 or 11 will it not work will it? That's exactly what's going on in my case. The hit counts are 35, 40, 53, etc. and the rule does not work. Could anybody advise please, how do I make it work when this darn hit count is anything more than 10?
The entire thing looks like this:
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 -j DROP
P.S. Does this "--state NEW" mean a new connection form the same IP address or a new connection from another (new) IP address? It's confusing.
iptables
edited Nov 21 at 23:10
Rui F Ribeiro
38.2k1475125
asked Nov 20 at 11:50
Dennis
11
New contributor
Dennis is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
This is what I have (in short):
--update --seconds 60 --hitcount 10 -j DROP
Does it mean that the rule will trigger if this hit count is 10 only? But what if the hit count is 9 or 11 will it not work will it? That's exactly what's going on in my case. The hit counts are 35, 40, 53, etc. and the rule does not work. Could anybody advise please, how do I make it work when this darn hit count is anything more than 10?
The entire thing looks like this:
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 -j DROP
P.S. Does this "--state NEW" mean a new connection form the same IP address or a new connection from another (new) IP address? It's confusing.
iptables
iptables
edited Nov 21 at 23:10
Rui F Ribeiro
38.2k1475125
asked Nov 20 at 11:50
Dennis
11
New contributor
Dennis is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited Nov 21 at 23:10
Rui F Ribeiro
38.2k1475125
asked Nov 20 at 11:50
Dennis
11
New contributor
Dennis is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited Nov 21 at 23:10
Rui F Ribeiro
38.2k1475125
edited Nov 21 at 23:10
Rui F Ribeiro
38.2k1475125
edited Nov 21 at 23:10
Rui F Ribeiro
38.2k1475125
38.2k1475125
asked Nov 20 at 11:50
Dennis
11
New contributor
Dennis is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked Nov 20 at 11:50
Dennis
11
asked Nov 20 at 11:50
Dennis
11
11
New contributor
Dennis is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
Dennis is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Dennis is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
This will only match if there are 10 (or more, explicitly stated in the manpage) hits within the last 60 seconds. Perhaps the counter you're seeing is including hits from more that 60 seconds ago?
– wurtel
Nov 20 at 12:04
Thank you for your comment. It's not the counter, it's live in my logs. The time is specified exactly in hours, minutes, and seconds (+ year, month, and day). It goes right through as if this rule does not exist at all...
– Dennis
Nov 20 at 12:11
Does it perhaps have anything to do with --limit-burst? Isn't it missing here is it?
– Dennis
Nov 20 at 12:30
add a comment |
This will only match if there are 10 (or more, explicitly stated in the manpage) hits within the last 60 seconds. Perhaps the counter you're seeing is including hits from more that 60 seconds ago?
– wurtel
Nov 20 at 12:04
Thank you for your comment. It's not the counter, it's live in my logs. The time is specified exactly in hours, minutes, and seconds (+ year, month, and day). It goes right through as if this rule does not exist at all...
– Dennis
Nov 20 at 12:11
Does it perhaps have anything to do with --limit-burst? Isn't it missing here is it?
– Dennis
Nov 20 at 12:30
This will only match if there are 10 (or more, explicitly stated in the manpage) hits within the last 60 seconds. Perhaps the counter you're seeing is including hits from more that 60 seconds ago?
– wurtel
Nov 20 at 12:04
This will only match if there are 10 (or more, explicitly stated in the manpage) hits within the last 60 seconds. Perhaps the counter you're seeing is including hits from more that 60 seconds ago?
– wurtel
Nov 20 at 12:04
Thank you for your comment. It's not the counter, it's live in my logs. The time is specified exactly in hours, minutes, and seconds (+ year, month, and day). It goes right through as if this rule does not exist at all...
– Dennis
Nov 20 at 12:11
Thank you for your comment. It's not the counter, it's live in my logs. The time is specified exactly in hours, minutes, and seconds (+ year, month, and day). It goes right through as if this rule does not exist at all...
– Dennis
Nov 20 at 12:11
Does it perhaps have anything to do with --limit-burst? Isn't it missing here is it?
– Dennis
Nov 20 at 12:30
Does it perhaps have anything to do with --limit-burst? Isn't it missing here is it?
– Dennis
Nov 20 at 12:30
add a comment |
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Dennis is a new contributor. Be nice, and check out our Code of Conduct.
Dennis is a new contributor. Be nice, and check out our Code of Conduct.
Dennis is a new contributor. Be nice, and check out our Code of Conduct.
Dennis is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f482953%2fiptables-update-recent-module%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
This will only match if there are 10 (or more, explicitly stated in the manpage) hits within the last 60 seconds. Perhaps the counter you're seeing is including hits from more that 60 seconds ago?
– wurtel
Nov 20 at 12:04
Thank you for your comment. It's not the counter, it's live in my logs. The time is specified exactly in hours, minutes, and seconds (+ year, month, and day). It goes right through as if this rule does not exist at all...
– Dennis
Nov 20 at 12:11
Does it perhaps have anything to do with --limit-burst? Isn't it missing here is it?
– Dennis
Nov 20 at 12:30