0

I'm moving from ufw to iptables.

There is a default "limit" rule in ufw, which kicks in if an IP address initiates 6+ connections in 30 seconds (sudo ufw limit ssh). I use that limit rule for SSH traffic (port 22).

I've read so many different ways to do this in iptables, that it's just confusing. I'm unsure whether to use the connlimit or limit or some other module.

What is the simplest way to map this rule 1:1 to iptables?

1

ufw manipulates on iptables, so since you're moving from ufw, I guess you can capture your iptables and see what ufw does there.

|improve this answer|||||
  • I don't understand what you mean? I'm looking for the iptables equivalent of ufw's ufw limit ssh – lonix Sep 13 '19 at 9:40
  • @lonix List iptables when ufw is active with this policy. – user147505 Sep 13 '19 at 9:45
-1

Using the recent extension

Based on @Tomasz's idea, I created the rule in ufw and inspected the result in iptables. Seems ufw uses the recent extension:

:LOG_REJECT - [0:0]

-A INPUT      -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m recent --set
-A INPUT      -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 30 --hitcount 6 -j LOG_REJECT
-A INPUT      -p tcp -m tcp --dport 22                                                                         -j ACCEPT
-A LOG_REJECT                                                     -m limit --limit 3/min                       -j LOG --log-prefix "[LIMITED SSH]"
-A LOG_REJECT                                                                                                  -j REJECT --reject-with icmp-port-unreachable

Using the limit extension

Which is slightly neater/simpler:

:LOG_REJECT - [0:0]

-A INPUT      -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m limit --limit 12/minute -j ACCEPT
-A INPUT      -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW                            -j LOG_REJECT
-A LOG_REJECT                                                     -m limit --limit 3/minute  -j LOG --log-prefix "[LIMITED SSH]" --log-level 7
-A LOG_REJECT                                                                                -j REJECT --reject-with icmp-port-unreachable

(Though I'm unsure if icmp-port-unreachable is a proper rejection message in this case.)

Using the connlimit extension

...maybe someone else can add that. :)

|improve this answer|||||
  • Why the downvote? – lonix Sep 13 '19 at 13:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.