I am trying to block icmp pings from a server if the packet count is greater than 2 per second (packet count reduced for testing). I tried these 2 rules separately but they don't seem to help:
iptables -A INPUT -p icmp --icmp-type echo-request -m recent --update --seconds 1 --hitcount 2 -j DROP iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT --match limit --limit 2/s --limit-burst 2
wht's wrong with these rules ?
I am pinging form another server using below command but the ping continues to get replies -
ping -n -i 0.2 192.168.2.86
also when I check iptables -nvL output - the packet count for the rule is not increasing ...
Machine used is centos 6.8
Some Progress: I added a default drop rule at the end of table:
iptables -A INPUT -p icmp -m icmp -j DROP
and then adding this rule dropped pings that exceeded the limit
iptables -A INPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 2/second -j ACCEPT -m comment --comment "icmprule1"
still not able to block the server completely.