Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was wondering, could somebody help me to understand/explain what this iptables rule does exactly?

iptables -A INPUT -i eth0 -p tcp ! --syn -m state --state NEW  -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Dropped"
iptables -A INPUT -i eth0 -p tcp ! --syn -m state --state NEW -j DROP

Thanks

share|improve this question
    
Great! Thanks to both. –  Kypton78 Sep 20 '10 at 4:06
    
Krypton78 - you're welcome. The appropriate thing to do is, when you're satisfied with one of the answers you've received, mark it as "accepted". If none of the answers are to your liking, then provide additional clarification in the comments of that answer. –  EEAA Sep 20 '10 at 4:12

2 Answers 2

Well, there are two rules there. I'll go through each of them.

I believe the following is accurate:

Rule 1

-A INPUT

Add this rule to the INPUT chain

-i eth0

This rule applies only to packets arriving via eth0

-p tcp

This rule applies only to tcp traffic

! --syn

Match packets that don't have the SYN bit set.

-m state

Track the state of this connection.

-state NEW

This only applies to new connections.

-m limit

Invoke the rate limiter.

--limit 5/m

Limit matches to 5 per minute.

--limit-burst 7

Set maximum number of initial matched packets to 7.

-j LOG

Write this entry to the iptables log.

--log-level

Set log verbosity to 4.

--log-prefix "Dropped"

Prefix the log message with "Dropped".

Rule 2

-A INPUT

Add this rule to the INPUT chain

-i eth0

This rule applies only to packets arriving via eth0

-p tcp

This rule applies only to tcp traffic

! --syn

This rule does not apply to SYN packets.

-m state

Track the state of this connection.

--state NEW

This only applies to new connections.

-j DROP

DROP packets that match the above conditions.

share|improve this answer

Log bad tcp packages(5 per minute and burst 7) and drop it

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.