iptables用recent来提高安全性，防止ssh暴力攻击

最新推荐文章于 2024-07-08 00:28:51 发布

misisippi68

最新推荐文章于 2024-07-08 00:28:51 发布

阅读量1.3k

点赞数 2

文章标签： linux iptables

本文链接：https://blog.csdn.net/misisippi68/article/details/105655831

版权

iptables的recent模块允许创建动态IP地址列表，用于增强安全性。通过设置、检查、更新和移除规则，可以有效地防止如SSH的暴力攻击。例如，限制在60秒内最多3次连接尝试，超出则丢弃后续请求。此外，还可以结合--seconds和--hitcount选项创建更精确的匹配规则，限制每IP在一分钟内的http连接数量。

摘要由CSDN通过智能技术生成

recent

extensions文档的链接: iptables-extensions.man.
recent
Allows you to dynamically create a list of IP addresses and then match against that list in a few different ways.
For example, you can create a “badguy” list out of people attempting to connect to port 139 on your firewall and then DROP all future packets from them without considering them.

–set, --rcheck, --update and --remove are mutually exclusive.

–name name
Specify the list to use for the commands. If no name is given then DEFAULT will be used.
[!] --set
This will add the source address of the packet to the list. If the source address is already in the list, this will update the existing entry. This will always return success (or failure if ! is passed in).
–rsource
Match/save the source address of each packet in the recent list table. This is the default.
–rdest
Match/save the destination address of each packet in the recent list table.
–mask netmask
Netmask that will be applied to this recent list.
[!] --rcheck
Check if the source address of the packet is currently in the list.
[!] --update
Like --rcheck, except it will update the “last seen” timestamp if it matches.
[!] --remove
Check if the source address of the packet is currently in the list and if so that address will be removed from the list and the rule will return true. If the address is not found