1

I have firewall rule that should accept all the connections, but drop connections from a ssh brute force attack (except 10.0.0.0/8 range). This rule will block an IP if it attempts more than 24 connections per 10minute.

    # Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp --dport 22 -s ! 10.0.0.0/8 -m state --state NEW -m recent --set --name SSH
-A INPUT -p tcp --dport 22 -s ! 10.0.0.0/8 -m state --state NEW -m recent --update --seconds 600 --hitcount 25 --rttl --name SSH -j DROP
-A INPUT -j ACCEPT
-A FORWARD -j ACCEPT
COMMIT

It errors out when I try to start iptables as bad arguement.

iptables: Applying firewall rules: Bad argument `10.0.0.0/8'

1 Answer 1

3

This was talked before in SF. iptables changed the way it accept parameters. Now the bang should be before the parameter, so your lines becomes this:

-A INPUT -p tcp --dport 22 ! -s 10.0.0.0/8 -m state --state NEW -m recent --set --name SSH
-A INPUT -p tcp --dport 22 ! -s 10.0.0.0/8 -m state --state NEW -m recent --update --seconds 600 --hitcount 25 --rttl --name SSH -j DROP

And yes, every blog in internet is wrong.

(This is a copy of my answer in StackOverflow, the problem is essentially the same)

2
  • Braiam - It errored against COMMIT. Line 14. iptables: Applying firewall rules: iptables-restore: line 14 failed. Updated the complete rule above in original post.
    – Chucks
    Dec 14, 2013 at 19:19
  • @Chucks that my dear fried is another question, but as far as it can be seen I don't see any problem in the rule, maybe you should instead add a new line at the end of the file...
    – Braiam
    Dec 14, 2013 at 19:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .