Ok, back again,
I was running limit and not seeing any results (e.g. limit in my packets), so I thought. I would go back to the basics and try some tests on ICMP limiting pings.
I have tried the following tests on four machines and get the same results, - e.g. pinging is not limited. The following is the code:
iptables -A INPUT -s 0/0 -p icmp -m limit --limit 1/hour --limit-burst 2 -j LOG --log-prefix "XXX ICMP LOG XXX "
iptables -A INPUT -s 0/0 -p icmp -m limit --limit 1/hour --limit-burst 2 -j DROP
iptables -A INPUT -s 0/0 -p icmp -m limit --limit 1/hour --limit-burst 2 -j LOG --log-prefix "XXX ICMP LOG AFTER DROP XXX "
iptables -A INPUT -s xxx.xxx.xxx.xxx -p icmp -j ACCEPT
iptables -A INPUT -s 0/0 -p icmp -j LOG --log-prefix "XXX ICMP DROP XXX "
Then ping from a remote machine outside of our firewall (The above rules are on the firewall).
I would expect 3 pings then nothing for an hour.
I get no limit on the pings, they continue without interruption.
I get the first LOG followed by the second LOG message.
As a sanity check If I comment out the rule which accepts the xxx.xxx.xxx.xxx address the pinging from that address stops.
This should be a simple test to add to any rule set. If anyone has the time could you try it out and let me know your results?
I tried on RedHat 7.2, 8.0 and 9.0 systems
Thanks
Len Laulainen
(952) 567-4211
len@xxxxxxxxx
