Skip to contentSkip to conversation

recent module --hitcount problem

DISCUSSION Sudheer Divakaran 1 participant 1 message Mar 7, 2005

lore
Share & tools
lore
#0 lore raw

Hi,

Is there anything wrong with these commands?. It seems that the recent module (0.3.1) is not considering the '--hitcount 10' attribute if the machine is running for a long time (in the long run). But when I tested these rules from another machine, it worked properly. But on the live server, iptables blocks hosts if they attempted to access the SMTP port within 60 seconds for a second time.

$IPT -A SMTP_HAMMER -j LOG --log-level debug $IPT -A SMTP_HAMMER -m recent --set --name hammer -j DROP

$IPT -A CHECK_SMTP -m recent --rcheck --seconds 480 --name hammer
-j DROP

$IPT -A CHECK_SMTP    -m recent     --rcheck --seconds 60  --hitcount 10     -j SMTP_HAMMER
$IPT -A CHECK_SMTP    -m recent     --update                      

-j ACCEPT
$IPT -A CHECK_SMTP -m recent --set
-j ACCEPT

$IPT -A INPUT -i $WAN_IFACE -p tcp --dport 25 -m state --state NEW
-j CHECK_SMTP

--

Thanks
Sudheer