☰

Iptables 规则匹配

tag-icon • tag-icon iptables
Iptables 规则匹配

有一个具有以下规则的 BAN 链：

-A BAN -m recent --name ping --rcheck --seconds 5 --hitcount 3 --rsource  -j RETURN

如果 5 秒内有 2 次 ping，它就会匹配，但是如果我从 ping 列表中添加删除不匹配的地址，则此上层规则永远不会匹配，为什么？

-A BAN -m recent --name ping --remove

答案1

由于第一条规则直到第三次遍历才会触发，而第二条规则会完全删除表条目，因此第一条规则将只观察它认为来自该 IP 地址的第一个数据包。

不要使用“删除”规则，“ping”表将会被很好地管理。

编辑：这里有一种方法可以使用 iptables 和最新模块来设置不同的封禁时间和封禁时间。我使用 10 秒内 5 次 ping 作为封禁标准，并且只设置 120 秒的封禁时间（只是为了便于检查）。

#!/bin/sh
FWVER=0.01
#
# ping_then_block Smythies 2018.02.05 Ver:0.01
#       An iptables recent module example of how to make the
#       ban time differ from the time to become banned.
#
#       See here:
#       https://askubuntu.com/questions/1002958/iptables-rule-matching
#
#       run as sudo
#

echo "Loading ping_then_block $FWVER..\n"

# The location of the iptables program
#
IPTABLES=/sbin/iptables

#Setting the EXTERNAL and INTERNAL interfaces and addresses for the network
#
# Smythies (for testing)
EXTIF="enp9s0"
EXTIP="192.168.111.104"
NETWORK="192.168.111.0/24"

UNIVERSE="0.0.0.0/0"

#Clearing any previous configuration
#
echo "  Clearing any existing rules and setting default policies.."
$IPTABLES -P INPUT ACCEPT
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -F FORWARD
# Otherwise, I can not seem to delete it later on
$IPTABLES -F ping-check
$IPTABLES -F ping-ban
# Delete user defined chains
$IPTABLES -X
# Reset all IPTABLES counters
$IPTABLES -Z

#######################################################################
# USER DEFINED CHAIN SUBROUTINES:
#
# ping-ban
#
# An ICMP echo request packet source IP address needs to added to
# the bad guy list
#
# Custom tables must exist before being referenced, hence the order
# of these sub-routines.
#
$IPTABLES -N ping-ban

$IPTABLES -A ping-ban -m recent --update --hitcount 1 --seconds 120 --name PING_BAN -j DROP
$IPTABLES -A ping-ban -m recent --set --name PING_BAN
$IPTABLES -A ping-ban -j DROP

#######################################################################
# USER DEFINED CHAIN SUBROUTINES:
#
# ping-check
#
# An ICMP echo request packet has arrived and the source IP
# address is either not on the bad guy list, or is but the penalty
# period criteria has been met.
#
# Check if the IP needs to be added to the bad guy list, and
# drop it if it does.
#
# Custom tables must exist before being referenced, hence the order
# of these sub-routines.
#
$IPTABLES -N ping-check

$IPTABLES -A ping-check -m recent --update --hitcount 5 --seconds 10 --name PING_TABLE -j ping-ban
$IPTABLES -A ping-check -m recent --set --name PING_TABLE
$IPTABLES -A ping-check -j ACCEPT

#
# If you are on the bad guy list, then you are banned.
#
$IPTABLES -A INPUT -i $EXTIF -m recent --update --seconds 120 --name PING_BAN -j LOG --log-prefix "BANPING:" --log-level info
$IPTABLES -A INPUT -i $EXTIF -m recent --update --seconds 120 --name PING_BAN -j DROP

#
# All ICMP? Or just ECHO requests?
#
$IPTABLES -A INPUT -i $EXTIF -p ICMP --icmp-type echo-request -s $UNIVERSE -d $EXTIP -j ping-check

$IPTABLES -A INPUT -i $EXTIF -s $UNIVERSE -m state --state ESTABLISHED,RELATED -j ACCEPT

echo ping_then_block rule set version $FWVER done.

相关内容