I am currently modifying some of my IPtables rules on a public server and have run into a bit of a dilemma. The goal is to do the following:
- Rate limit the amount of SSH connections that can be made per minute, from hosts
- For all hosts using an internal IP Address (172.21-30.x.x), let them skip being subject to rule #1
My first thought was to put an initial rule that says "All IP Addresses in range 172.21-30.0.0/16 are ACCEPTED". However, wouldn't this then drop all packets NOT in this range? I need to permit all connections, just select which are subject to rate limiting. Is there a way to configure the source of LOGDROP (see below) to apply to all ranges EXCEPT those beginning with 172.21-30?
The rules currently in place are:
Chain INPUT (policy ACCEPT) target prot opt source destination LOGDROP tcp -- anywhere anywhere tcp dpt:ssh state NEW recent: UPDATE seconds: 60 hit_count: 4 name: DEFAULT side: source tcp -- anywhere anywhere tcp dpt:ssh state NEW recent: SET name: DEFAULT side: source Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain LOGDROP (1 references) target prot opt source destination LOG all -- anywhere anywhere limit: avg 2/min burst 5 LOG level warning prefix `Possible SSH Attack ' DROP all -- anywhere anywhere
Thanks for any assistance. Aaron