Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am having trouble limiting the connection to SSH from a unique ip address. I tried the following rules to restrict an ip address from logging to SSH for more than 3 times in 100 seconds, but it didn't work.


-A LOGDROP -m limit --limit 4/minute --limit-burst 3 -j LOG --log-prefix "LOGDROP: " --log-level info
-A INPUT -s -p tcp --dport 22 -m state --state NEW -m recent --set
-A INPUT -s -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 100 --hitcount 3 --rttl -j LOGDROP
-A INPUT -s -p tcp --dport 22 -j ACCEPT

What could be the problem?

share|improve this question
The line -m recent --set was there, I just missed it out when copy and paste. Sorry for that. – Question Overflow Jan 6 '13 at 10:18

This will help you:

sudo iptables -s -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
sudo iptables -s -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent  --update --seconds 100 --hitcount 3 -j DROP
share|improve this answer
Can you explain what is wrong with my configuration? Your proposal doesn't log the dropped connection. – Question Overflow Jan 6 '13 at 10:11

I figured there is nothing wrong with the configuration. My understanding of SSH connection is flawed. A wrong login password does not cause the SSH connection to be dropped. Hence the hit count limit is not affected until I do a reconnect.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.