2

This is the rule in iptables for stop sync_flood attacks:

iptables -A INPUT -m state --state NEW -p tcp -m tcp --syn \
-m recent --name synflood --set

iptables -A INPUT -m state --state NEW -p tcp -m tcp --syn \
-m recent --name synflood --update --seconds 1 --hitcount 60 -j DROP

Error:

iptables: Unknown error 4294967295

I don't know what exactly to do, this ocurrs when insert the last rule "-m recent --name synflood --update --seconds 1 --hitcount 60 -j DROP"

Here the kernel version

2.6.18-274.12.1.el5PAE
Improve this question
1
  • Maybe there's some kernel module that you need to load first?
    – joechip
    Aug 16, 2012 at 1:34

1 Answer 1

Reset to default
2

A quick search on Google for your error message lead to CentOS bug 3632, which says:

This is not a bug. You should increase maximum possible value for --hitcount parameter (20 by default) by setting ipt_recent module option ip_pkt_list_tot.

For example:

# cat /etc/modprobe.d/ipt.conf 
options ipt_recent ip_pkt_list_tot=200

Then reload module ipt_recent.

You're setting hitcount to 60, so this sounds like it's probably the root of your problem.

Improve this answer
3
  • Thanks I make the changes you posted, and sorry, but, how i can reload the module ipt_recent? Thanks. Restarted iptables (service iptables restart) but the problem persist.
    – Kiwi
    Aug 16, 2012 at 2:04
  • You can reboot, if that's an option. Otherwise, you should be able to modprobe -r ipt_recent, and then modprobe ipt_recent. This might fail because the recent module is in use, so you can try preceding it by service iptables stop to drop all of your firewall rules first. Make sure you save them!
    – larsks
    Aug 16, 2012 at 2:09
  • Perfect! Many thanks, now the module was loaded correctly.
    – Kiwi
    Aug 16, 2012 at 2:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .