I'm using those rules to limit/stop port scan.
iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 10 -j DROP
If i run nmap the scan take a very long time and that's good . The thing that I dont understand is that when i try to load a webpage quickly to trigger iptable ban nothing happen!
Is this a normal behaviour ?
iptables
is the right place to do this because there is nothing special about the traffic at the IP level that would indicate it's trying to bruteforce a password page.