Hello, Alex a écrit : > > I've set up a few basic rules to throttle SMTP traffic from an > individual host should they make more than 10 connections in ten > seconds: > > iptables -I INPUT -p tcp --dport 25 -i eth0 -m state --state NEW -m recent --set > iptables -I INPUT -p tcp --dport 25 -i eth0 -m state --state NEW -m > recent --update --seconds 10 --hitcount 10 -j LOG > iptables -I INPUT -p tcp --dport 25 -i eth0 -m state --state NEW -m > recent --update --seconds 10 --hitcount 10 -j DROP > > Is this the correct way to do this? I notice the seconds value can't > be any greater than 20. What is the reason for this? --seconds or --hitcount ? The --hitcount value cannot be greater that the ip_pkt_list_tot parameter of the ipt_recent/xt_recent kernel module (otherwise it would never match), and the parameter default value is 20. See the iptables man page for details. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
