iptables - expert challenge

Question

If have a challenge to secure an ubuntu LTS server using iptables. It gets about 2000 attacks every hour - unfortunately from a range of IP addresses, and unfortunately I cannot lock it down as some requests (in between) are valid external users logging onto their services. Does anyone out there have a script for setting up the following/similar logic with iptables?

• rule 0 "if whitelisted" then jump to rule 6
• rule 1 "if blacklisted then DROP"
• rule 2 "if contacting non-listed port, then blacklist and DROP"
• rule 3 "if contacting listed port, then record source and ACCEPT" (used in rule 5)
• rule 4 "if last seen 6 times or more per minute then DROP for 10 minutes.
• rule 5 "if rule 4 was true twice within 24 hours, then blacklist and DROP"
• rule 6 "if contacting listed port, then record source and ACCEPT" (used in rule 7)
• rule 7 "if last seen 5 times or more per minute then DROP for 10 minutes.
• rule 8 "-j ACCEPT"

Answer 1

Your rules don't make sense. Rule 4 and later will never be actioned because anything getting to rule 3 will always be true and therefore accepted.

Perhaps you should take a look at fail2ban or deny hosts.