0

I have blocked all connection with iptables and allowed only the loopback:

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

next I want to allow only ssh connections, and also I want to record the IP address of each attempt to access port 22 using the recent module.then I want to to see if that IP address has attempted to connect 2 or more times within the last 60 seconds, and if not then the packet is accepted:

iptables -A INPUT -p tcp --dport 22 -m recent --set --name ssh --rsource
iptables -A INPUT -p tcp --dport 22 -m recent ! --rcheck --seconds 60 --hitcount 2 --    name ssh --rsource -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT 
iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT 
iptables -A INPUT -p tcp --sport 22 -j ACCEPT 
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP

the problem that probably didn't write it right so can someone show me whhat is my problem

1
  • 1
    Somewhat unrelated to your question, but you probably don't want to do this iptables -A INPUT -p tcp --sport 22 -j ACCEPT. With a rule like this, I can use netcat and set the source port nc -p 22 and connect to any listening port on your server.
    – slillibri
    Jun 1, 2011 at 11:26

1 Answer 1

1

You mean... something like ....

iptables -N BADGUY
iptables -t filter -I BADGUY -m recent --set --name badguys

iptables -A INPUT -i $OUTS -p tcp --syn --dport ssh -m recent --name ssh --set
iptables -A INPUT -i $OUTS -p tcp --syn --dport ssh -m recent --name ssh --rcheck --seconds 300 --hitcount 6 -j BADGUY
iptables -A INPUT -i $OUTS -p tcp --syn --dport ssh -m recent --name ssh --rcheck --seconds  30 --hitcount 2 -j DROP

?

You may also want to look at fail2ban wich does exacly what you want.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy