I am currently modifying some of my IPtables rules on a public server and have run into a bit of a dilemma. The goal is to do the following:

  1. Rate limit the amount of SSH connections that can be made per minute, from hosts
  2. For all hosts using an internal IP Address (172.21-30.x.x), let them skip being subject to rule #1

My first thought was to put an initial rule that says "All IP Addresses in range 172.21-30.0.0/16 are ACCEPTED". However, wouldn't this then drop all packets NOT in this range? I need to permit all connections, just select which are subject to rate limiting. Is there a way to configure the source of LOGDROP (see below) to apply to all ranges EXCEPT those beginning with 172.21-30?

The rules currently in place are:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
LOGDROP    tcp  --  anywhere             anywhere            tcp dpt:ssh state NEW recent: UPDATE seconds: 60 hit_count: 4 name: DEFAULT side: source
           tcp  --  anywhere             anywhere            tcp dpt:ssh state NEW recent: SET name: DEFAULT side: source

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain LOGDROP (1 references)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere            limit: avg 2/min burst 5 LOG level warning prefix `Possible SSH Attack '
DROP       all  --  anywhere             anywhere

Thanks for any assistance. Aaron


Your initial instinct is correct. The first rule should be "allow all packets from this source range", followed by the "meter incoming packets" rule(s). IPTABLES rules are evaluated in the order they appear, with the first match winning. The only thing I would do differently is to make the INPUT policy DROP, rather than having an explicit DROP rule at the end of the LOGDROP chain. That, though, is purely personal preference. All it really does is have one less rule in one chain to look at when you read it with human eyes.

  • So by adding that ACCEPT rule, IPTables won't whitelist only that address? For some reason I was under the impression (based on different articles read) that inserting just the ACCEPT rule will DENY (drop) all that do not get accepted. Just re-confirming before I make this change and potentially take out our dev instance :) – acelives May 14 '15 at 14:24
  • It will do whatever the first matching rule tells it to do. If there are no matching rules, it will do whatever the chain's policy says. Your configuration has "go to LOGDROP", followed by "rate limit", followed by "DROP". Adding an ACCEPT rule prior to the ratelimit will mean anything not ACCEPTED explicitly by the new rule will fall through to "rate limit" – John May 14 '15 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.