This is an old revision of the document!
Statefull and Powerfull Firewall.
This is not a 100% proof setup as it does not block based on the result of authentication.
It just work based on connection.
iptables -N BRTBLK iptables -A INPUT -p tcp --dport 22 -m state –state NEW -j BRTBLK iptables -A BRTBLK -m recent –set –name SSH iptables -A BRTBLK -m recent –update –seconds 45 –hitcount 5 –name SSH -j DROP
Replace <Exception> with your IP.
You can use multiple rules with diff. IP to allow exceptions.
iptables -N BRTBLK iptables -A INPUT -p tcp –dport 22 -s <Exception> -j ACCEPT iptables -A INPUT -p tcp --dport 22 -m state –state NEW -j BRTBLK iptables -A BRTBLK -m recent –set –name SSH iptables -A BRTBLK -m recent –update –seconds 45 –hitcount 5 –name SSH -j DROP
iptables -N BRTBLK iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j BRTBLK iptables -A BRTBLK -m recent --set --name SSH iptables -A BRTBLK -m recent --update --seconds 45 --hitcount 5 --name SSH -j LOG --log-level info --log-prefix "Bad IP : " iptables -A BRTBLK -m recent --update --seconds 45 --hitcount 5 --name SSH -j DROP