0

I'm using those rules to limit/stop port scan.

iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 10 -j DROP

If i run nmap the scan take a very long time and that's good . The thing that I dont understand is that when i try to load a webpage quickly to trigger iptable ban nothing happen!

Is this a normal behaviour ?

4
  • what are you trying to achieve and why?
    – pQd
    Jul 17, 2012 at 19:43
  • 2
    Depending on the browser, it can actually reuse the same connection. I would test with several different browsers at the same time, say firefox, opera, chrome, konqueror, whatever, and see if you get the results you want. But, with a hitcount of 10, you may still not reach it. Test with a smaller number and multiple browsers and see if you get it, then after verifying you can raise it back up.
    – lsd
    Jul 17, 2012 at 19:43
  • I'm using this to prevent bruteforcing a password page . Is it possible to modify the rules to achieve this objective ?
    – isoman
    Jul 17, 2012 at 20:12
  • 1
    @isoman: I don't think iptables is the right place to do this because there is nothing special about the traffic at the IP level that would indicate it's trying to bruteforce a password page. Jul 17, 2012 at 21:07

1 Answer 1

1

Hmm, if your goal is to protect a password page, you may want to look at Fail2Ban. Basically, it will run a regex against your log files to detect suspicious activity. At a trigger level, it will automatically insert iptables rules to block that activity.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .