Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have firewall rule that should accept all the connections, but drop connections from a ssh brute force attack (except 10.0.0.0/8 range). This rule will block an IP if it attempts more than 24 connections per 10minute.

    # Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp --dport 22 -s ! 10.0.0.0/8 -m state --state NEW -m recent --set --name SSH
-A INPUT -p tcp --dport 22 -s ! 10.0.0.0/8 -m state --state NEW -m recent --update --seconds 600 --hitcount 25 --rttl --name SSH -j DROP
-A INPUT -j ACCEPT
-A FORWARD -j ACCEPT
COMMIT

It errors out when I try to start iptables as bad arguement.

iptables: Applying firewall rules: Bad argument `10.0.0.0/8'
share|improve this question

1 Answer 1

up vote 3 down vote accepted

This was talked before in SF. iptables changed the way it accept parameters. Now the bang should be before the parameter, so your lines becomes this:

-A INPUT -p tcp --dport 22 ! -s 10.0.0.0/8 -m state --state NEW -m recent --set --name SSH
-A INPUT -p tcp --dport 22 ! -s 10.0.0.0/8 -m state --state NEW -m recent --update --seconds 600 --hitcount 25 --rttl --name SSH -j DROP

And yes, every blog in internet is wrong.

(This is a copy of my answer in StackOverflow, the problem is essentially the same)

share|improve this answer
    
Braiam - It errored against COMMIT. Line 14. iptables: Applying firewall rules: iptables-restore: line 14 failed. Updated the complete rule above in original post. –  Chucks Dec 14 '13 at 19:19
    
@Chucks that my dear fried is another question, but as far as it can be seen I don't see any problem in the rule, maybe you should instead add a new line at the end of the file... –  Braiam Dec 14 '13 at 19:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.