iptables -I INPUT -i eth1 -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name DEFAULT --rsource

I understand the first half of the command but have no idea what the second half (after -m state) does. I have read a couple of resources online and looked at 'man iptables' and although I have an idea of what each individual switch does, I don't know how to make sense of it together.


This rule will add the source ip address to ipset called DEFAULT for every new connection that calling port 22 which coming from eth1 using tcp protocol

  • Using the -m switch to load a module

  • The state module is able to examine the state of a packet and determine if it is NEW, ESTABLISHED or RELATED. NEW refers to incoming packets that are new incoming connections that weren't initiated by the host system.

  • The recent module takes a number of options:

    1. --name xyz give a name to the particular ‘class’ you are defining
    2. --rsource in the list you keep, use the remote (source) address
| improve this answer | |
  • @anna Does the answer work good with you ? – Wissam Roujoulah Dec 12 '16 at 6:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.