Re: SSH Brute force attacks

[Łukasz Hejnak <sziftgroup@xxxxx>]

Sadus . wrote:
> $ipt -A SSH_Brute_Force -m recent ! --rcheck --name SSH --seconds 60 
> --hitcount 3 -j RETURN
> -j RETURN didn't work here. It was blocking all my ssh connections, so i
> used ACCEPT and its working now.

yes, because most probably by default all packets get dropped at the end
of Your INPUT chain, thus If You wan't to perform any other checks of
the ssh packet You need a -j RETURN, and a -j ACCEPT later,
if not a -j ACCEPT here is ok :)

--
With regards
Łukasz Hejnak