Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to write an adaptive firewall using iptables, and am not clear on how the recent module is working. For example, see http://blog.zioup.org/2008/iptables_recent/

Snippet from my iptables:

...input stuff, established, etc...
-A INPUT -m conntrack --ctstate NEW -j limiter
... more input stuff...
# very end of chain, nothing matches. Likely unauthorized port
-A INPUT -m conntrack --ctstate NEW -m recent --name PORTSCAN --set

# limiter table
-A limiter -m recent --update --name PORTSCAN
-A limiter -m recent --rcheck --name PORTSCAN --hitcount 10 --seconds 300 -j LOG

This setup works. Watching /proc/net/xt_recent/PORTSCAN, running nmap on a closed port adds my ip, and then trying to connect to, say, port 80 (which is open) updates the list. Additionally, if I connect to just open ports, I am not added to the list.

My question is, when I try to combine the two lines in the limiter table into one, it no longer works.

#-A limiter -m recent --update --name PORTSCAN
#-A limiter -m recent --rcheck --name PORTSCAN --hitcount 10 --seconds 300 -j LOG
-A limiter -m recent --update --name PORTSCAN --hitcount 10 --seconds 300 -j LOG

Scanning an open port after a closed one does not update the list (although if the limit of 10 packets/300 secs is overrun, it is logged).

My understanding was that the update line would be equivalent to the other two. Why not?

share|improve this question
1  
What's the point to combine update with rcheck? update itself is like rcheck – poige Aug 20 '13 at 17:47
    
That's sort of the question. If update is like rcheck, then why doesn't the "combined" line work? Note that the combined line doesn't have both update and rcheck, just an update. – Ben P. Aug 20 '13 at 18:25
1  
I think your input here is very abrupt and unclear, Ben. – poige Aug 21 '13 at 16:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.