is there a more simple way to count new connections?

dadaniel · Fri May 11, 2012 2:32 pm

I found this one in the wiki, is there a way to do the same without the need for four rules?

add action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w chain=forward comment="put Src IP on blocklist after 4 new SSH connections in one minute" connection-state=new disabled=no dst-port=22 protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m chain=forward connection-state=new disabled=no dst-port=22 protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m chain=forward connection-state=new disabled=no dst-port=22 protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m chain=forward connection-state=new disabled=no dst-port=22 protocol=tcp src-address-list=!ournet

dadaniel · Thu May 24, 2012 2:52 pm

*bump*

vasilevkirill · Thu May 24, 2012 3:13 pm

rule performed on a single connection, respectively, in the same rule can not be traced four attempts to connect.

is there a more simple way to count new connections?

is there a more simple way to count new connections?

Re: is there a more simple way to count new connections?

Re: is there a more simple way to count new connections?

Who is online