When I add these rules to INPUT:

-A INPUT -p icmp -m icmp --icmp-type 8 -m recent --name ping --set
-A INPUT -m recent --name ping --hitcount 3 --rcheck --seconds 20 -j DROP

this will ban (all connection types) from the IP address(es) from the ping list – those who try to ping 3 times in 20 seconds.

However, when I redirect the traffic to another chain:

-A INPUT -p icmp -m icmp --icmp-type 8 -j BAN

and do the same in this same chain:

-A BAN -p icmp -m icmp --icmp-type 8 -m recent --name ping --set
-A BAN -m recent --name ping --hitcount 3 --rcheck --seconds 60 -j DROP

... this only blocks the ICMP traffic, but not the other traffic from the IP address(es). Why is this?

  • @Scott thank you. You are right, it is a good answer.
    – EdiD
    Feb 4, 2018 at 14:54

1 Answer 1


The -j DROP rule affects only traffic that has been redirected into the BAN chain — and that’s only the ping traffic.  Other traffic from the blacklisted IP address(es) never gets into the BAN chain, and so it never hits the -j DROP rule.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .