blocked ips not showing up in iptables chains

Question

i have used the following rules, to block port-scanners for 24 hours, and unblock scanner ip address after 24 hour, and log the attacker ip address.

iptables -A INPUT -m recent --name portscan --rcheck --seconds 86400    -j DROP 
iptables -A FORWARD -m recent --name portscan --rcheck --seconds 86400 -j DROP

iptables -A INPUT -m recent --name portscan --remove
iptables -A FORWARD -m recent --name portscan --remove

 
iptables -A INPUT -p tcp -m tcp --dport 139 -m recent --name portscan --set -j LOG --log-prefix "portscan:"
iptables -A INPUT -p tcp -m tcp --dport 139 -m recent --name portscan --set -j DROP
iptables -A FORWARD -p tcp -m tcp --dport 139 -m recent --name portscan --set -j LOG --log-prefix "portscan:"
iptables -A FORWARD -p tcp -m tcp --dport 139 -m recent --name portscan --set -j DROP

everything works fine,and the scanner ip address is getting blocked by iptables. but i am not able to find the blocked ip in any of iptables chains. Scanner ip is only getting logged in the kernel.log file, and i looking for a possible way to remove a single ip instead of re-starting iptables itself.

Answer 1

The recent module does not create new rules for each offender that you can query with with Iptables. It simply maintains the list of offenders in memory

http://ipset.netfilter.org/iptables-extensions.man.html#lbBW

/proc/net/xt_recent/* are the current lists of addresses and information about each entry of each list.

Each file in /proc/net/xt_recent/ can be read from to see the current list or written to using the following commands to modify the list:

echo +addr >/proc/net/xt_recent/DEFAULT

to add addr to the DEFAULT list

 echo -addr >/proc/net/xt_recent/DEFAULT

to remove addr from the DEFAULT list

echo / >/proc/net/xt_recent/DEFAULT

to flush the DEFAULT list (remove all entries)