Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to setup iptables rules to only allow 3 attempts by an IP per minute to connect to the servir via SSH, and drop all the connections after to prevent SSH attacks; but it seems i'm doing something wrong!

-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name DEFAULT --rsource
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 3 --name DEFAULT --rsource -j DROP
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT


share|improve this question

I think you better have to use fail2ban, because your ipfilter rules also block legitimate connections. fail2ban will only block IPs after failed connections.

Next, a common pratice is to ban IPs when they try to connect to port 22, and bind your ssh server to another port. You then face only a couple illegitimate connection per week if your computer is not a well known target.

For the precise question you asked :

iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP
share|improve this answer
Since the server is a low end vps, I'm trying to keep resource consumption to the minimum while maintaining it as secure as possible. I've already changed the ssh server port. Should I keep those rules (above) to the new port and ban the default one (22)? – MGP Sep 22 '12 at 17:48

You can implement what you want with the following 2 rules

iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set

iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 3 -j DROP

Note that using -Awhich adds rules to the end of the chain can fall foul of the way that iptables rules are processed i.e. in order so if there is a general DROP or an allow rule before yours is reached than they will never be acted on.

Having said that you may also find fail2ban is a better way of implementing this kind of block.

share|improve this answer
When i try to add those rules, i get an error message: iptables: No chain/target/match by that name. – MGP Sep 22 '12 at 16:54
Upvote for fail2ban. – Michael B Sep 22 '12 at 20:47

You might want to try the LIMIT module.

iptables -A INPUT -p tcp --dport 22 -m limit --limit 3/minute -j ACCEPT
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.