iptables rule explanation

Question

I was wondering, could somebody help me to understand/explain what this iptables rule does exactly?

iptables -A INPUT -i eth0 -p tcp ! --syn -m state --state NEW  -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Dropped"
iptables -A INPUT -i eth0 -p tcp ! --syn -m state --state NEW -j DROP

Thanks

Answer 1

Well, there are two rules there. I'll go through each of them.

I believe the following is accurate:

Rule 1

-A INPUT

Add this rule to the INPUT chain

-i eth0

This rule applies only to packets arriving via eth0

-p tcp

This rule applies only to tcp traffic

! --syn

Match packets that don't have the SYN bit set.

-m state

Track the state of this connection.

-state NEW

This only applies to new connections.

-m limit

Invoke the rate limiter.

--limit 5/m

Limit matches to 5 per minute.

--limit-burst 7

Set maximum number of initial matched packets to 7.

-j LOG

Write this entry to the iptables log.

--log-level

Set log verbosity to 4.

--log-prefix "Dropped"

Prefix the log message with "Dropped".

Rule 2

-A INPUT

Add this rule to the INPUT chain

-i eth0

This rule applies only to packets arriving via eth0

-p tcp

This rule applies only to tcp traffic

! --syn

This rule does not apply to SYN packets.

-m state

Track the state of this connection.

--state NEW

This only applies to new connections.

-j DROP

DROP packets that match the above conditions.

Answer 2

Log bad tcp packages(5 per minute and burst 7) and drop it