I have a script running every minute by a crontab.
This script scans the system logs and grabs the IPs of every failed attempt to login on the server's dovecot, exim or ssh and add them to an ipset, blocking that IP forever.
The problem is this: the script runs every minute and is doing well what it is supposed to do, that is, grab the IP of attackers and add them to ipset, but I still have log entries of the same IP trying to attack the system for an hour.
In other words. Suppose someone tries to attack the system now. Within one minute the script will run and grab all IPs with more than 3 password failures and add them to an ipset. Even so, I have logs of IPs trying to brute force attack the site for hours and the connection is not interrupted.
My supposition is this: ipset works by adding an IP to a table and that IP will be blocked the next time that IP comes to the server but the connection will not drop if the IP is already connected to the server trying to attack. Is this right? If it is, is there a way to interrupt a connection going on?
NOTE: Just for the record: the commands I have used to add the ipset named blocking to iptables was like this:
iptables -A INPUT -p tcp --dport XX -m set --set blocking src -j DROP
where XX is the port I am blocking.