[CentOS] Re: Simple IPTABLES Question

Wed Aug 20 15:01:02 UTC 2008
Matt <lm7812 at gmail.com>

> I added these rules to IPTABLES to slow brute force attacks.
>
> iptables -A INPUT -p tcp --dport 22 -s my_subnet/24 -j ACCEPT
> iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent
> --set --name SSH
> iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent
> --update --seconds 60 --hitcount 5 --rttl --name SSH -j DROP
>
> I would like log entries when connections are dropped to see that its
> working.  How do I do that?
>
> I am guessing I would add this before the drop.
>
> iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent
> --update --seconds 60 --hitcount 5 --rttl --name SSH -j LOG
> --log-prefix 'SSH attack: '

That seems to have worked.  Another quick question.  Would it be
better to TARPIT rather then DROP the packets?

Matt