Sign up ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

I'm trying to write an adaptive firewall using iptables, and am not clear on how the recent module is working. For example, see

Snippet from my iptables:

...input stuff, established, etc...
-A INPUT -m conntrack --ctstate NEW -j limiter
... more input stuff...
# very end of chain, nothing matches. Likely unauthorized port
-A INPUT -m conntrack --ctstate NEW -m recent --name PORTSCAN --set

# limiter table
-A limiter -m recent --update --name PORTSCAN
-A limiter -m recent --rcheck --name PORTSCAN --hitcount 10 --seconds 300 -j LOG

This setup works. Watching /proc/net/xt_recent/PORTSCAN, running nmap on a closed port adds my ip, and then trying to connect to, say, port 80 (which is open) updates the list. Additionally, if I connect to just open ports, I am not added to the list.

My question is, when I try to combine the two lines in the limiter table into one, it no longer works.

#-A limiter -m recent --update --name PORTSCAN
#-A limiter -m recent --rcheck --name PORTSCAN --hitcount 10 --seconds 300 -j LOG
-A limiter -m recent --update --name PORTSCAN --hitcount 10 --seconds 300 -j LOG

Scanning an open port after a closed one does not update the list (although if the limit of 10 packets/300 secs is overrun, it is logged).

My understanding was that the update line would be equivalent to the other two. Why not?

share|improve this question
What's the point to combine update with rcheck? update itself is like rcheck – poige Aug 20 '13 at 17:47
That's sort of the question. If update is like rcheck, then why doesn't the "combined" line work? Note that the combined line doesn't have both update and rcheck, just an update. – Ben P. Aug 20 '13 at 18:25
I think your input here is very abrupt and unclear, Ben. – poige Aug 21 '13 at 16:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.