Hello all, I have a problem with the limit module. The goal is to limit the incoming ICMP echo-requests to max 1/s. The following rule does it (as example using the INPUT) : -A INPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j ACCEPT The above is working fine. But when there is a rule for accepting the ESTABLISHED packets, the limit does not work: -A INPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j ACCEPT -A INPUT -m state --state ESTABLISHED -j ACCEPT With these 2 rules the limit does not work... Using the "iptables -A INPUT -m state --state ESTABLISHED -p ICMP -j ACCEPT" and "watch -d -n 1 iptables -nvL" is showing, that all the ICMP echo-requests from the same host are being considered ESTABLISHED. I am not sure, but I think after sending the ICMP echo-reply the session should be closed. With new echo-request a new session is opened. Please could somebody confirm, if this behavior is correct ? And if yes please explain ? See also: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598513 and from "http://www.netfilter.org/documentation/HOWTO//packet-filtering-HOWTO-7.html " : "ESTABLISHED A packet which belongs to an existing connection (i.e., a reply packet, or outgoing packet on a connection which has seen replies)." And from "http://www.lug.or.kr/docs/iptables-tutorial/onepage/"; : "The reply packet is considered as being ESTABLISHED, as we have already explained. However, we can know for sure that after the ICMP reply, there will be absolutely no more legal traffic in the same connection. For this reason, the connection tracking entry is destroyed once the reply has traveled all the way through the Netfilter structure." I am using iptables v1.4.14. Thanks in advance, Regards, Podo. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
