Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This is the rule in iptables for stop sync_flood attacks:

iptables -A INPUT -m state --state NEW -p tcp -m tcp --syn \
-m recent --name synflood --set

iptables -A INPUT -m state --state NEW -p tcp -m tcp --syn \
-m recent --name synflood --update --seconds 1 --hitcount 60 -j DROP

Error:

iptables: Unknown error 4294967295

I don't know what exactly to do, this ocurrs when insert the last rule "-m recent --name synflood --update --seconds 1 --hitcount 60 -j DROP"

Here the kernel version

2.6.18-274.12.1.el5PAE
share|improve this question
    
Maybe there's some kernel module that you need to load first? –  joechip Aug 16 '12 at 1:34
add comment

1 Answer

up vote 1 down vote accepted

A quick search on Google for your error message lead to CentOS bug 3632, which says:

This is not a bug. You should increase maximum possible value for --hitcount parameter (20 by default) by setting ipt_recent module option ip_pkt_list_tot.

For example:

# cat /etc/modprobe.d/ipt.conf 
options ipt_recent ip_pkt_list_tot=200

Then reload module ipt_recent.

You're setting hitcount to 60, so this sounds like it's probably the root of your problem.

share|improve this answer
    
Thanks I make the changes you posted, and sorry, but, how i can reload the module ipt_recent? Thanks. Restarted iptables (service iptables restart) but the problem persist. –  Kiwi Aug 16 '12 at 2:04
    
You can reboot, if that's an option. Otherwise, you should be able to modprobe -r ipt_recent, and then modprobe ipt_recent. This might fail because the recent module is in use, so you can try preceding it by service iptables stop to drop all of your firewall rules first. Make sure you save them! –  larsks Aug 16 '12 at 2:09
    
Perfect! Many thanks, now the module was loaded correctly. –  Kiwi Aug 16 '12 at 2:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.