Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have firewall rule that should accept all the connections, but drop connections from a ssh brute force attack (except range). This rule will block an IP if it attempts more than 24 connections per 10minute.

    # Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp --dport 22 -s ! -m state --state NEW -m recent --set --name SSH
-A INPUT -p tcp --dport 22 -s ! -m state --state NEW -m recent --update --seconds 600 --hitcount 25 --rttl --name SSH -j DROP

It errors out when I try to start iptables as bad arguement.

iptables: Applying firewall rules: Bad argument `'
share|improve this question
up vote 3 down vote accepted

This was talked before in SF. iptables changed the way it accept parameters. Now the bang should be before the parameter, so your lines becomes this:

-A INPUT -p tcp --dport 22 ! -s -m state --state NEW -m recent --set --name SSH
-A INPUT -p tcp --dport 22 ! -s -m state --state NEW -m recent --update --seconds 600 --hitcount 25 --rttl --name SSH -j DROP

And yes, every blog in internet is wrong.

(This is a copy of my answer in StackOverflow, the problem is essentially the same)

share|improve this answer
Braiam - It errored against COMMIT. Line 14. iptables: Applying firewall rules: iptables-restore: line 14 failed. Updated the complete rule above in original post. – Chucks Dec 14 '13 at 19:19
@Chucks that my dear fried is another question, but as far as it can be seen I don't see any problem in the rule, maybe you should instead add a new line at the end of the file... – Braiam Dec 14 '13 at 19:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.