Take the 2-minute tour ×

I want to make a script that sees if a number of connection attempts are made from one or more IPs ($CT_MULTIPLE_IP_THRESHOLD) in an ammount of time ($CT_TIME). If this happens, than in that ammount of time ($CT_TIME), search through all IPs and ban those that exceed the maximum number of allowed trials for one IP ($CT_SINGLE_IP_THRESHOLD).

I have found the recent module which semms to be able to achieve this.

iptables -A INPUT -m recent --name port_multiple_scan --rcheck --hitcount $CT_SINGLE_IP_THRESHOLD --seconds $CT_TIME -j DROP

Q1: How can I do the threshold for multiple IPs (the hitcount can be used only with --rcheck or --update) ?

Q2: Can I do a ban IP (let's say in hosts.deny) instead of -j DROP?

Q3: Is there a betterm module (instead of recent)to use and how?

share|improve this question

Your Answer



Browse other questions tagged or ask your own question.