Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The manpage for iptables 'recent' module explains that the module itself accepts parameters. How does one go about setting these parameters? I would imagine they would be set somewhere where the module is loaded. I do not know where that is.

Does anyone have any ideas?

share|improve this question

4 Answers 4

If you load the module by hand, you just add it to the modprobe command line:

modprobe ipt_recent param1=val1 param2=val2

Otherwise, if it's being loaded automatically, you can create a file in /etc/modprobe.d, say /etc/modprobe.d/ipt_recent, with contents of:

options ipt_recent param1=val1 param2=val2

Which will do the same thing as the modprobe line above.

share|improve this answer
1  
Keep in mind at least on Ubuntu all files inside /etc/modprobe.d/ need to end with .conf. Also the module seem to differ from system tot system: on Ubuntu it's xt_recent. I couldn't get it to work using an conf file so I did it manually via: modbrobe -r xt_recent ; modprobe xt_recent ip_list_tot=value –  TD_Nijboer Aug 29 '13 at 15:06
    
On RHEL6 it appear to be xt_recent now also. –  flickerfly Oct 4 '13 at 14:52

If the module is already loaded, you can still change the parameter by manipulating the value in /sys/module/ipt_recent/parameters/.

For example, to change the value of ip_pkt_list_tot you can do:

echo 200 > /sys/module/ipt_recent/parameters/ip_pkt_list_tot

Of course, you got to have the permission.

share|improve this answer
    
RHEL6 will not permit changes of permission to even sudo these that I can find. Perhaps this is a protection from what planetbeing mentions below. –  flickerfly Oct 4 '13 at 14:54

I don't have the reputation to reply to TopQ's answer, but I signed up for an account just to tell people not to do what he suggests. The source code of the module (http://lxr.linux.no/linux+v3.9/net/netfilter/xt_recent.c) has no provision to detect changes to that parameter and no provision to reallocate the kernel buffer responsible for keeping track of recent hits.

Therefore, if you chmod that parameter writable and subsequently change it, subsequent entries to existing recent hit logs will overrun the previously allocated kernel buffers and cause a kernel panic.

share|improve this answer

Warning: Understand that changing this has an impact on the memory usage of the machine as these details are stored in memory and iptables require greater resources to deal with storing larger amounts of data.

Setup the xt_recent configuration file

Create the file /etc/modprobe.d/xt_recent.conf and include a line like this:

options xt_recent ip_list_tot=50 ip_pkt_list_tot=150

Don't forget to add some comments about what you're doing. Future you will thank you.

Prepare to reinitialize xt_recent

Before we remove any rules in your firewall currently using the recent module or simply disable the firewall. You may want to save your rules before you do this with sudo iptables-save > somefile.txt or maybe sudo service iptables save if you distro supports that.

Choose one of these two depending on your situation to clean up. You could also simply restart your computer at this point and skip to adding rules.

To shutdown iptables

sudo service iptables stop

To Remove specific Rules:

  1. Use iptables -L --line-numbers to list the rules and look for "recent:" in the rules.
  2. Use iptables -D INPUT # where # is the line number to delete rules.

Reinitialize xt_recent

Remove the module with sudo modprobe -r xt_recent. Add it back with sudo modprobe xt_recent.

Check to make sure your parameters were applied with sudo cat /sys/module/xt_recent/parameters/ip_pkt_list_tot.

Add the rules that you couldn't

If you stopped iptables sudo service iptables start to bring it back.

Add your rules back in with the higher values you wanted.

Bonus:

sudo watch 'iptables -nvL' will allow you to watch stuff hit the xt_recent rules.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.