Correspondência de regras Iptables

Question

Existe uma cadeia de BAN com esta regra:

-A BAN -m recent --name ping --rcheck --seconds 5 --hitcount 3 --rsource  -j RETURN

corresponderá quando houver 2 pings em 5 segundos, mas se eu adicionar remover endereços da lista de ping que não correspondam a essa regra superior nunca corresponderá ao porquê?

-A BAN -m recent --name ping --remove

    

Answer 1

Como sua primeira regra não é acionada até a terceira vez em que foi executada e sua segunda regra exclui a entrada da tabela inteiramente, a primeira regra sempre observará apenas o que ela considera ser o primeiro pacote desse endereço IP.

Não use a regra "remover", e a tabela "ping" será gerenciada muito bem.

EDIT: Aqui está uma maneira de usar o iptables e o módulo recente para ter um tempo de banimento diferente do tempo para ser banido. Eu usei 5 pings em 10 segundos como os critérios de proibição e apenas 120 segundos de tempo de proibição (apenas para facilitar a verificação).

#!/bin/sh
FWVER=0.01
#
# ping_then_block Smythies 2018.02.05 Ver:0.01
#       An iptables recent module example of how to make the
#       ban time differ from the time to become banned.
#
#       See here:
#       https://sobrelinux.info/questions/165515/iptables-rule-matching"Loading ping_then_block $FWVER..\n"

# The location of the iptables program
#
IPTABLES=/sbin/iptables

#Setting the EXTERNAL and INTERNAL interfaces and addresses for the network
#
# Smythies (for testing)
EXTIF="enp9s0"
EXTIP="192.168.111.104"
NETWORK="192.168.111.0/24"

UNIVERSE="0.0.0.0/0"

#Clearing any previous configuration
#
echo "  Clearing any existing rules and setting default policies.."
$IPTABLES -P INPUT ACCEPT
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -F FORWARD
# Otherwise, I can not seem to delete it later on
$IPTABLES -F ping-check
$IPTABLES -F ping-ban
# Delete user defined chains
$IPTABLES -X
# Reset all IPTABLES counters
$IPTABLES -Z

#######################################################################
# USER DEFINED CHAIN SUBROUTINES:
#
# ping-ban
#
# An ICMP echo request packet source IP address needs to added to
# the bad guy list
#
# Custom tables must exist before being referenced, hence the order
# of these sub-routines.
#
$IPTABLES -N ping-ban

$IPTABLES -A ping-ban -m recent --update --hitcount 1 --seconds 120 --name PING_BAN -j DROP
$IPTABLES -A ping-ban -m recent --set --name PING_BAN
$IPTABLES -A ping-ban -j DROP

#######################################################################
# USER DEFINED CHAIN SUBROUTINES:
#
# ping-check
#
# An ICMP echo request packet has arrived and the source IP
# address is either not on the bad guy list, or is but the penalty
# period criteria has been met.
#
# Check if the IP needs to be added to the bad guy list, and
# drop it if it does.
#
# Custom tables must exist before being referenced, hence the order
# of these sub-routines.
#
$IPTABLES -N ping-check

$IPTABLES -A ping-check -m recent --update --hitcount 5 --seconds 10 --name PING_TABLE -j ping-ban
$IPTABLES -A ping-check -m recent --set --name PING_TABLE
$IPTABLES -A ping-check -j ACCEPT

#
# If you are on the bad guy list, then you are banned.
#
$IPTABLES -A INPUT -i $EXTIF -m recent --update --seconds 120 --name PING_BAN -j LOG --log-prefix "BANPING:" --log-level info
$IPTABLES -A INPUT -i $EXTIF -m recent --update --seconds 120 --name PING_BAN -j DROP

#
# All ICMP? Or just ECHO requests?
#
$IPTABLES -A INPUT -i $EXTIF -p ICMP --icmp-type echo-request -s $UNIVERSE -d $EXTIP -j ping-check

$IPTABLES -A INPUT -i $EXTIF -s $UNIVERSE -m state --state ESTABLISHED,RELATED -j ACCEPT

echo ping_then_block rule set version $FWVER done.