rendered paste bodyiptables -N SSH_WHITELIST
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j SSH_WHITELIST
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j ULOG --ulog-prefix SSH_brute_force
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j DROP
server:/usr/src/linux# iptables -L -v
Chain INPUT (policy ACCEPT 2164 packets, 357K bytes)
pkts bytes target prot opt in out source destination
0 0 tcp -- any any anywhere anywhere tcp dpt:ssh state NEW recent: SET name: SSH side: source
0 0 SSH_WHITELIST tcp -- any any anywhere anywhere tcp dpt:ssh state NEW
0 0 ULOG tcp -- any any anywhere anywhere tcp dpt:ssh state NEW recent: UPDATE seconds: 60 hit_count: 4 TTL-Match name: SSH side: source ULOG copy_range 0 nlgroup 1 prefix `SSH_brute_force' queue_threshold 1
0 0 DROP tcp -- any any anywhere anywhere tcp dpt:ssh state NEW recent: UPDATE seconds: 60 hit_count: 4 TTL-Match name: SSH side: source
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 2522 packets, 316K bytes)
pkts bytes target prot opt in out source destination
Chain SSH_WHITELIST (1 references)
pkts bytes target prot opt in out source destination
server:/usr/src/linux# lsmod
Module Size Used by
ipt_recent 8984 3
xt_tcpudp 3328 4
ipt_LOG 6016 0
ipt_ULOG 7940 1
iptable_filter 3200 1
ip_tables 11592 1 iptable_filter
ipt_REJECT 4352 0
xt_state 2688 4
x_tables 14340 7 ipt_recent,xt_tcpudp,ipt_LOG,ipt_ULOG,ip_tables,ipt_REJECT,xt_state
nf_conntrack_ipv4 15756 4
nf_conntrack 51784 2 xt_state,nf_conntrack_ipv4