A very basic chain question
Hello list,
Please bother with me as this time I have a very basic question about iptables chain and I have not found any answer yet. I am in a process to create a complex ssh checking rule where conditions are checked one by one and finally the valid packets are accepted. The scenario is like
```````````` check limit ( say 10/min) --> check connlimit ( 2 per ip ) --> check hashlimit ( 2 attempt per min) ---> ACCEPT. ````````````````````
I have made a chain called sshrate but don't find the way to append the rules in that chain one by one. If I simply append the rules as accept then the very first rule is working bypassing the other two and my objective is to pass the rules in a pipe one by one and finally accept the valid packets. Could any one enlighten me in that direction ?
Thanks
Hello,
Quoted 9 lines · J. Bakshi
check limit ( say 10/min) --> check connlimit ( 2 per ip ) --> check hashlimit ( 2 attempt per min) ---> ACCEPT.
I have made a chain called sshrate but don't find the way to append the rules in that chain one by one. If I simply append the rules as accept then the very first rule is working bypassing the other two and my objective is to pass the rules in a pipe one by one and finally accept the valid packets. Could any one enlighten me in that direction ?
DROP (or REJECT) packets which fail early checks if possible :
-A sshrate -m <!check1> -j DROP
-A sshrate -m <!check2> -j DROP
-A sshrate -m <check3> -j ACCEPT
or put all checks in the same rule if possible :
-A sshrate -m <check1> -m <check2> -m <check3> -j ACCEPT
or cascade chains :
-A sshrate -m <check1> -j check1ok
-A check1ok -m <check2> -j check2ok
-A check2ok -m <check2> -j ACCEPT
Quoted 20 lines · Pascal Hambourg
Hello,
Quoted 9 lines · J. Bakshi
check limit ( say 10/min) --> check connlimit ( 2 per ip ) --> check hashlimit ( 2 attempt per min) ---> ACCEPT.
I have made a chain called sshrate but don't find the way to append the rules in that chain one by one. If I simply append the rules as accept then the very first rule is working bypassing the other two and my objective is to pass the rules in a pipe one by one and finally accept the valid packets. Could any one enlighten me in that direction ?
DROP (or REJECT) packets which fail early checks if possible :
(quoted diff) +0
-3-A sshrate -m <!check1> -j DROP -A sshrate -m <!check2> -j DROP -A sshrate -m <check3> -j ACCEPT
Quoted 4 lines
or put all checks in the same rule if possible :
-A sshrate -m <check1> -m <check2> -m <check3> -j ACCEPT
Very nice. The second one is really nice.
many many thanks.
Quoted 11 lines
or cascade chains :
(quoted diff) +0
-4-A sshrate -m <check1> -j check1ok -A check1ok -m <check2> -j check2ok -A check2ok -m <check2> -j ACCEPT --To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html