Iptables “recent” module – setting module parameters

iptables

The manpage for iptables 'recent' module explains that the module itself accepts parameters. How does one go about setting these parameters? I would imagine they would be set somewhere where the module is loaded. I do not know where that is.

Does anyone have any ideas?

Best Answer

If you load the module by hand, you just add it to the modprobe command line:

modprobe ipt_recent param1=val1 param2=val2

Otherwise, if it's being loaded automatically, you can create a file in /etc/modprobe.d, say /etc/modprobe.d/ipt_recent, with contents of:

options ipt_recent param1=val1 param2=val2

Which will do the same thing as the modprobe line above.

Related Solutions

Linux iptables – Troubleshoot Slow iptables -L Command

Include the -n option so it doesn't try to use DNS to resolve names for every ip address, network and port. Then it will be fast.

Linux – iptables rate-limit module problem

Your rule does not appear to specify any particular origin. After accepting 20 NEW connections in a minute, it stops accepting NEW connections.

You need to use the recent module in order for iptables to remember where the connections are coming from and blocking people that connect too fast from the same address. This takes two rules: one for iptables to "learn" the address, and then one for iptables to see how many times that address has hit the server in the specified time:

/sbin/iptables -A INPUT -p TCP -m state --state NEW -d xx.xxx.xxx.xx --dport 80 -m recent --set
/sbin/iptables -A INPUT -p TCP -m state --state NEW -d xx.xxx.xxx.xx --dport 80 -m recent --update --seconds 60 --hitcount 20 -j DROP

This article goes into more details.

Best Answer

Related Solutions

Linux iptables – Troubleshoot Slow iptables -L Command

Linux – iptables rate-limit module problem

Related Topic