Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I was looking into some new rules but I can't seem to get them to work at the moment, The error i keep getting is iptables: Applying firewall rules: iptables-restore: line 36 failed and that's the COMMIT.

I did move the COMMIT to see if i could narrow down the issue and I think it could be on the line with -A LIMIT_INDIVIDUAL_CURRENT -m recent --update --seconds 300 --hitcount 200 -j DROP does any one have an idea.

*filter
:INPUT DROP [13:672]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [1604:100070]
:LIMIT_INDIVIDUAL_NEW - [0:0]
:LIMIT_INDIVIDUAL_CURRENT - [0:0]
:LIMIT_OVERALL_NEW - [0:0]
-A INPUT -i lo -j ACCEPT
#Apache
-A INPUT -p tcp --dport 80 -m state --state RELATED,ESTABLISHED -j LIMIT_INDIVIDUAL_CURRENT
-A INPUT -p tcp --dport 80 --syn -m state --state NEW -j LIMIT_INDIVIDUAL_NEW
#Teamspeak
-A INPUT -p tcp --dport 30033 -m state --state RELATED,ESTABLISHED -j LIMIT_INDIVIDUAL_CURRENT
-A INPUT -p tcp --dport 30033 --syn -m state --state NEW -j LIMIT_INDIVIDUAL_NEW
-A INPUT -p tcp --dport 10011 -m state --state RELATED,ESTABLISHED -j LIMIT_INDIVIDUAL_CURRENT
-A INPUT -p tcp --dport 10011 --syn -m state --state NEW -j LIMIT_INDIVIDUAL_NEW
-A INPUT -p udp --dport 9987 -j ACCEPT
#Iptables DoS and Slowloris mitigation
-A LIMIT_INDIVIDUAL_CURRENT -m recent --set
-A LIMIT_INDIVIDUAL_CURRENT -p tcp --tcp-flags FIN FIN -m recent --remove
-A LIMIT_INDIVIDUAL_CURRENT -m recent --update --seconds 300 --hitcount 200 -j DROP
-A LIMIT_INDIVIDUAL_CURRENT -j ACCEPT
-A LIMIT_INDIVIDUAL_NEW -m recent --set
-A LIMIT_INDIVIDUAL_NEW -m recent --update --seconds 1 --hitcount 30 -j DROP
-A LIMIT_INDIVIDUAL_NEW -j LIMIT_OVERALL_NEW
-A LIMIT_OVERALL_NEW -m limit --limit 500/second -j ACCEPT
-A LIMIT_OVERALL_NEW -j DROP
COMMIT
share|improve this question
1  
I only see 28 lines in the above output. Are you sure you're showing us the version of the ruleset that has the problem? –  MadHatter Feb 6 '13 at 4:42
    
Oh ye sorry, this is only the filter part but I have had it all working and I'm sure that its this part somewhere. I think it could be because I need to install something that iptables requires for one of these rules maybe? –  ZeroErrors Feb 6 '13 at 14:28

1 Answer 1

up vote 2 down vote accepted

I tried this, and it seems likely that your suspicions are correct:

[root@risby home]# iptables -A FOO -m recent --update --seconds 300 --hitcount 200 -j DROP
iptables: Invalid argument. Run `dmesg' for more information.

[root@risby home]# dmesg|tail -1
[1141835.281122] xt_recent: hitcount (200) is larger than packets to be remembered (20)

man iptables reveals the following:

   --hitcount hits
          This option must be used in conjunction with one of --rcheck or
          --update.  When used, this will narrow the match to only happen
          when the address is in the list and packets had  been  received
          greater  than  or  equal to the given value. This option may be
          used along with --seconds to  create  an  even  narrower  match
          requiring  a  certain  number  of  hits  within a specific time
          frame. The maximum value for the hitcount parameter is given by
          the "ip_pkt_list_tot" parameter of the xt_recent kernel module.
          Exceeding this value on the command line will cause the rule to
          be rejected.

So if I were you, I'd try dropping that 200 to 10. If that makes the problem go away (or at least, leave that line) then you've identified the issue. I ran a strings on the kernel module and looked for that parameter, and found amongst others the following two entries:

parm=ip_pkt_list_tot:number of packets per IP address to remember (max. 255)
parmtype=ip_pkt_list_tot:uint

which say to me that this parameter can be set as an argument when the module is loaded, but can't in any case exceed 255. That's the sort of limit that makes me think that even recompiling your own kernel won't help, and you'd have to rewrite the module to use more than a one-byte (uint=unsigned integer) counter; I suspect that's not going to be on the agenda.

Hopefully the above sheds some light on the issue, and possible remediations.

share|improve this answer
    
I dropped both of the --hitcount parameters to 20 and it is working, Did not think of trying to enter the rule with the command, Thanks. –  ZeroErrors Feb 7 '13 at 8:51
    
Glad to hear it! If you'll forgive my mentioning it, local etiquette is that once you're happy with an answer, you accept it by clicking the "tick" outline next to it; this drives the SF reputation system for the authors of both question and answer. My apologies if you already knew that. –  MadHatter Feb 7 '13 at 8:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.