My SSH Highport solution has been working well (see last post), so now I need to setup some firewall rules for rate-limiting so that I can expose the port to the internet and not permit huge dictionary attacks against the port. So I setup some iptables rules and ... it doesn't work. I found a bunch of examples of doing this and I followed them very closely but no luck. So I'm wondering if there is something about using the directors that is causing problems with these rules.
On the directors here's what I have: # iptables -L -n --line-numbers ... Chain RH-Firewall-1-INPUT (1 references) ... 16 tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:33322 recent: SET name: DEFAULT side: source 17 DROP tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:33322 recent: UPDATE seconds: 60 hit_count: 4 name: DEFAULT side: source 18 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:33322 19 REJECT 0 -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited If I take out the two 'recent' rules then I can login via SSH on port 33322. But with the rules in I get a timeout and 'connection closed' when I try to login via ssh on port 33322. Here's the rules: iptables -I RH-Firewall-1-INPUT 16 -i eth0 -m state --state NEW -p tcp --dport 33322 -m recent --set iptables -I RH-Firewall-1-INPUT 17 -i eth0 -m state --state NEW -p tcp --dport 33322 -m recent --update --seconds 60 --hitcount 4 -j DROP iptables -I RH-Firewall-1-INPUT 18 -i eth0 -m state --state NEW -p tcp --dport 33322 -j ACCEPT Ok, what I've found is that if I set the 'hit_count' high to say 100 then I can login but the connection dies very quickly (actually it just hangs). So I think the limit rule is applying to more than just NEW packets. The higher that I set 'hit_count' the longer the connection will last. So is there something wrong with the way I've implemented this or is this a bug in iptables or the kernel? ???? Gerry _______________________________________________ LinuxVirtualServer.org mailing list - lvs-users@LinuxVirtualServer.org Send requests to [EMAIL PROTECTED] or go to http://lists.graemef.net/mailman/listinfo/lvs-users