Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using those rules to limit/stop port scan.

iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 10 -j DROP

If i run nmap the scan take a very long time and that's good . The thing that I dont understand is that when i try to load a webpage quickly to trigger iptable ban nothing happen!

Is this a normal behaviour ?

share|improve this question
    
what are you trying to achieve and why? –  pQd Jul 17 '12 at 19:43
2  
Depending on the browser, it can actually reuse the same connection. I would test with several different browsers at the same time, say firefox, opera, chrome, konqueror, whatever, and see if you get the results you want. But, with a hitcount of 10, you may still not reach it. Test with a smaller number and multiple browsers and see if you get it, then after verifying you can raise it back up. –  lsd Jul 17 '12 at 19:43
    
I'm using this to prevent bruteforcing a password page . Is it possible to modify the rules to achieve this objective ? –  isoman Jul 17 '12 at 20:12
1  
@isoman: I don't think iptables is the right place to do this because there is nothing special about the traffic at the IP level that would indicate it's trying to bruteforce a password page. –  David Schwartz Jul 17 '12 at 21:07

1 Answer 1

up vote 1 down vote accepted

Hmm, if your goal is to protect a password page, you may want to look at Fail2Ban. Basically, it will run a regex against your log files to detect suspicious activity. At a trigger level, it will automatically insert iptables rules to block that activity.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.