Network Security

Network Security RSS

iptables -m recent conflicting

•

Join Date: Oct 2008

Posts: 46

Reputation: shwick is an unknown quantity at this point

Solved Threads: 0

shwick

Offline

Light Poster

iptables -m recent conflicting

Oct 19th, 2008

Running ubuntu 8.04.

I'm using the recent module in two different chains SSH_PROTECT and FTP_PROTECT. What I want is for an ip to be allowed to make a new connection to SSH port 22 once every 60 seconds and FTP port 21 once every 30 seconds.

Help with Code Tags

(Toggle Plain Text)

iptables -N SSH_PROTECT
iptables -A SSH_PROTECT -m recent --set
iptables -A SSH_PROTECT -m recent --update --seconds 60 --hitcount 2 -j DROP
iptables -A SSH_PROTECT -j DROP

iptables -N FTP_PROTECT
iptables -A FTP_PROTECT -m recent --set
iptables -A FTP_PROTECT -m recent --update --seconds 30 --hitcount 2 -j DROP
iptables -A FTP_PROTECT -j DROP

iptables -A INPUT 
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp --dport 22 -j SSH_PROTECT
iptables -A INPUT -m state --state NEW -i eth1 -p tcp --dport 21 -j FTP_PROTECT
iptables -P INPUT DROP

What actually happens is when an ip makes a new connection to either port 21 or 22, they cannot connect to port 21 for the next 30 seconds or port 22 for the next 60 seconds.

The recent module is only storing a session for an ip. I need it to store a session for an ip/port, or one session for each chain it's in. Is this possible?