I have setup a firewall with iptables to ratelimit connections based on content. The following is an example of one of my rules that stops wordpress bruteforce attacks.
iptables -A INPUT -p tcp -m tcp --dport 80 -m string --algo bm --string "POST /wp-login.php" -m recent --set --name wp_brute --rsource
iptables -A INPUT -p tcp -m tcp --dport 80 -m string --algo bm --string "POST /wp-login.php" -m recent --name wp_brute --rcheck --seconds 60 --hitcount 4 -j LOG --log-level=6 --log-prefix="Wordpress Attack:"
iptables -A INPUT -p tcp -m tcp --dport 80 -m string --algo bm --string "POST /wp-login.php" -m recent --name wp_brute --rcheck --seconds 60 --hitcount 4 -j REJECT --reject-with tcp-reset
I am trying to get another rule that is a little tricker because I want to block based on the response packet from an incoming connection. For example if someone tries to login using pop3 and the response is authentication failed then I want to block the original IP. However the above rule will not work obviously because the sport is the original dport.
I tried this but I think it should be the output table not the input table.
iptables -A INPUT -p tcp -m tcp --dport 110 -m string --algo bm --string "Password supplied for " -m recent --set --name pop3_brute --rsource
iptables -A INPUT -p tcp -m tcp --dport 110 -m string --algo bm --string "Password supplied for " -m recent --name pop3_brute --rcheck --seconds 60 --hitcount 4 -j LOG --log-level=6 --log-prefix="POP3 Attack:"
iptables -A INPUT -p tcp -m tcp --dport 110 -m string --algo bm --string "Password supplied for " -m recent --name pop3_brute --rcheck --seconds 60 --hitcount 4 -j REJECT --reject-with tcp-reset
So then I tried this
iptables -A OUTPUT -p tcp -m tcp --sport 110 -m string --algo bm --string "Password supplied for " -m recent --set --name pop3_brute --rsource
iptables -A OUTPUT -p tcp -m tcp --sport 110 -m string --algo bm --string "Password supplied for " -m recent --name pop3_brute --rcheck --seconds 60 --hitcount 4 -j LOG --log-level=6 --log-prefix="POP3 Attack:"
iptables -A OUTPUT -p tcp -m tcp --sport 110 -m string --algo bm --string "Password supplied for " -m recent --name pop3_brute --rcheck --seconds 60 --hitcount 4 -j REJECT --reject-with tcp-reset
I am a little new to iptables so having a little trouble figuring out how to block the remote IP based on the response packet I return to it on a hit counter.