IPtables. Preventing multiple failed logins


iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 --rttl --name SSH -j DROP

Fairly easy to figure out. you fail 10 times in a min, you get booted. I should change that to much less now that I look at it.



IPtables Block

Iptables block info

-A INPUT -p tcp -m state --state NEW,ESTABLISHED -s 192.168.1.0/24 --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -d 192.168.2.0/24 --sport 22 -j ACCEPT

Actually this only allows listed ranges to login.