Thread: iptables: --rcheck works like --update

i have written bash script iptables shall secure system:

code:

#!/bin/bash -eu  typeset -a rule  rule[0]='-p forward drop' rule[1]='-p input drop' rule[2]='-a input -i lo -j accept' rule[3]='-a input -j accept -m state --state established' rule[4]='-a input -p tcp --dport 22 -m state --state new -m recent --name ssh --set' rule[5]='-a input -j drop -p tcp --dport 22 -m recent --hitcount 4 --name ssh --rcheck --seconds 60' rule[6]='-a input -j drop -p tcp --dport 22 -m recent --hitcount 16 --name ssh --rcheck --seconds 3600' rule[7]='-a input -j accept -p tcp --dport 22' rule in "${rule[@]}" 	iptables -c ${rule:3} > /dev/null 2>&1 || iptables $rule done

the rules droping incoming connections except ssh. have created rules shall prevent brute force attacks. if ip address connects more 3 times in minute or 15 times in hour blocked time.

problem on every try timestamp updated example: user creates within 5 seconds 3 connections , blocked 1 minute. tries every 20 seconds create new connection every attempt update timestamp. means after few days couldn't create successfull connection.

i'm wondering why every blocked attempt updates timestamp. thought --update doing this. maybe have explanation that.

Forum The Ubuntu Forum Community Ubuntu Official Flavours Support Networking & Wireless [ubuntu] iptables: --rcheck works like --update

Ubuntu