I'm having a strange problem with -m recent: my iptables setup uses 4
ipt_recent entries, and I have noticed that sometimes when an address
is added to one of the chains, it appears on the /proc/net/ipt_recent/*
list for the other entries.
I am using Debian unstable, kernel 2.6.11-686-smp and iptables v1.3.1
The relevant rules are:
-A INPUT -m recent --update --hitcount 2 --name BANME --rsource
--seconds 3600 -j DROP
-A INPUT -m recent -p tcp --dport 22 --rcheck --name SSHGO --rsource
--seconds 300 -j loga
-A INPUT -m recent -p tcp --dport 22 --rcheck --name SSHOPEN --rsource
-j loga
-A INPUT -m recent -p tcp --dport 12349 --set --name SSHGO --rsource -j
logd
-A INPUT -m recent -p tcp --dport 12342 --set --name SSHOPEN --rsource
-j logd
-A INPUT -m recent -p tcp --dport 22 --set --name SSHTRY --rsource -j logd
#more rules to allow access to services etc.
-A INPUT -m recent --set --name BANME --rsource -j DROP
-A loga -j ULOG --ulog-qthreshold 1 --ulog-prefix A
-A loga -j ACCEPT
-A logd -j ULOG --ulog-qthreshold 1 --ulog-prefix D
-A logd -j DROP
$ cat /proc/net/ipt_recent/BANME
src=192.228.79.200 ttl: 51 last_seen: 754299 oldest_pkt: 4 last_pkts:
4294710297, 4294722481, 4294722488, 754299
src=192.228.79.203 ttl: 51 last_seen: 4294722473 oldest_pkt: 2
last_pkts: 4294710304, 4294722473
src=200.37.124.195 ttl: 110 last_seen: 870857 oldest_pkt: 3 last_pkts:
861797, 864823, 870857
$ cat /proc/net/ipt_recent/SSHGO
src=200.37.124.195 ttl: 110 last_seen: 861797 oldest_pkt: 1 last_pkts:
861797
src=60.213.3.18 ttl: 110 last_seen: 3510943 oldest_pkt: 1 last_pkts:
3510943
$ sudo iptables -vL
pkts bytes target prot opt in out source
destination
...
6 1668 DROP all -- any any anywhere
anywhere recent: UPDATE seconds: 3600 hit_count: 2 name:
BANME side:source
0 0 loga tcp -- any any anywhere
anywhere recent: CHECK seconds: 300 name: SSHGO side: source
tcp dpt:ssh
0 0 loga tcp -- any any anywhere
anywhere recent: CHECK name: SSHOPEN side: source tcp dpt:ssh
0 0 logd tcp -- any any anywhere
anywhere recent: SET name: SSHGO side: source tcp dpt:12349
0 0 logd tcp -- any any anywhere
anywhere recent: SET name: SSHOPEN side: source tcp dpt:12342
1 48 logd tcp -- any any anywhere
anywhere recent: SET name: SSHTRY side: source tcp dpt:ssh
...
3 706 DROP all -- any any anywhere
anywhere recent: SET name: BANME side: source
- Daniel
