Re: Block an IP if there is number of connection within a time limit ??

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



2007/6/27, Grant Taylor <gtaylor@xxxxxxxxxxxxxxxxx>:
On 6/27/2007 12:12 AM, Ditro - BipinDas wrote:
> I do have a Exim mail server with IPTABLES and TCP WRAPPER as
> firewall. Yesterday I had noticed that,there is continuous smpt
> connection from an IP. I would like to block these IP,if there is
> more than 10 connection in 30 second. Is this possible using IPTABLES
> command. If yes,Please guide me.

Use the IPTables "recent" match extension to match on newly established
SMTP sessions and reject them if there have been more than 10 in the
last 30 seconds.

iptables -I INPUT -p tcp --dport 25 -i eth0 -m state --state NEW -m recent \
 --update --seconds 30 --hitcount 10 -j DROP





Grant. . . .




[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux