Block an IP if there is number of connection within a time limit ??
Dear List,
I do have a Exim mail server with IPTABLES and TCP WRAPPER as firewall. Yesterday I had noticed that,there is continuous smpt connection from an IP. I would like to block these IP,if there is more than 10 connection in 30 second. Is this possible using IPTABLES command. If yes,Please guide me.
Thanks in Advance
Quoted 1 line · Ditro - BipinDas
I do have a Exim mail server with IPTABLES and TCP WRAPPER as firewall. Yesterday I had noticed that,there is continuous smpt connection from an IP. I would like to block these IP,if there is more than 10 connection in 30 second. Is this possible using IPTABLES command. If yes,Please guide me.
Use the IPTables "recent" match extension to match on newly established SMTP sessions and reject them if there have been more than 10 in the last 30 seconds.
Grant. . . .
2007/6/27, Grant Taylor <[email protected]>:
Quoted 10 lines · Ditro - BipinDas
Quoted 5 lines
I do have a Exim mail server with IPTABLES and TCP WRAPPER as firewall. Yesterday I had noticed that,there is continuous smpt connection from an IP. I would like to block these IP,if there is more than 10 connection in 30 second. Is this possible using IPTABLES command. If yes,Please guide me.
Use the IPTables "recent" match extension to match on newly established SMTP sessions and reject them if there have been more than 10 in the last 30 seconds.
iptables -I INPUT -p tcp --dport 25 -i eth0 -m state --state NEW -m recent \
--update --seconds 30 --hitcount 10 -j DROP
Quoted 6 lines
Grant. . . .