libxt_recent.man revision d09cc98b481efc6ea121ce7acd739a87a381c6ed
15821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)Allows you to dynamically create a list of IP addresses and then match against 25821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)that list in a few different ways. 35821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles).PP 45821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)For example, you can create a "badguy" list out of people attempting to connect 55821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)to port 139 on your firewall and then DROP all future packets from them without 65821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)considering them. 72a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles).PP 8c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)\fB\-\-set\fP, \fB\-\-rcheck\fP, \fB\-\-update\fP and \fB\-\-remove\fP are 92a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)mutually exclusive. 101320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci.TP 116d86b77056ed63eb6871182f42a9fd5f07550f90Torne (Richard Coles)\fB\-\-name\fP \fIname\fP 121320f92c476a1ad9d19dba2a48c72b75566198e9Primiano TucciSpecify the list to use for the commands. If no name is given then 138bcbed890bc3ce4d7a057a8f32cab53fa534672eTorne (Richard Coles)\fBDEFAULT\fP will be used. 142a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles).TP 151320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci[\fB!\fP] \fB\-\-set\fP 161320f92c476a1ad9d19dba2a48c72b75566198e9Primiano TucciThis will add the source address of the packet to the list. If the source 171320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucciaddress is already in the list, this will update the existing entry. This will 182a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)always return success (or failure if \fB!\fP is passed in). 195821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles).TP 205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)\fB\-\-rsource\fP 215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)Match/save the source address of each packet in the recent list table. This 222a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)is the default. 235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles).TP 245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)\fB\-\-rdest\fP 255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)Match/save the destination address of each packet in the recent list table. 265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles).TP 275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)\fB\-\-mask\fP \fInetmask\fP 285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)Netmask that will be applied to this recent list. 295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles).TP 305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)[\fB!\fP] \fB\-\-rcheck\fP 315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)Check if the source address of the packet is currently in the list. 325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles).TP 33c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)[\fB!\fP] \fB\-\-update\fP 342a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)Like \fB\-\-rcheck\fP, except it will update the "last seen" timestamp if it 355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)matches. 365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles).TP 375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)[\fB!\fP] \fB\-\-remove\fP 382a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)Check if the source address of the packet is currently in the list and if so 392a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)that address will be removed from the list and the rule will return true. If 402a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)the address is not found, false is returned. 412a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles).TP 422a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)\fB\-\-seconds\fP \fIseconds\fP 432a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)This option must be used in conjunction with one of \fB\-\-rcheck\fP or 442a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)\fB\-\-update\fP. When used, this will narrow the match to only happen when the 452a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)address is in the list and was seen within the last given number of seconds. 462a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles).TP 472a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)\fB\-\-reap\fP 482a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)This option can only be used in conjunction with \fB\-\-seconds\fP. 498bcbed890bc3ce4d7a057a8f32cab53fa534672eTorne (Richard Coles)When used, this will cause entries older than the last given number of seconds 508bcbed890bc3ce4d7a057a8f32cab53fa534672eTorne (Richard Coles)to be purged. 518bcbed890bc3ce4d7a057a8f32cab53fa534672eTorne (Richard Coles).TP 522a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)\fB\-\-hitcount\fP \fIhits\fP 535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)This option must be used in conjunction with one of \fB\-\-rcheck\fP or 545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)\fB\-\-update\fP. When used, this will narrow the match to only happen when the 555821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)address is in the list and packets had been received greater than or equal to 565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)the given value. This option may be used along with \fB\-\-seconds\fP to create 576d86b77056ed63eb6871182f42a9fd5f07550f90Torne (Richard Coles)an even narrower match requiring a certain number of hits within a specific 581320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tuccitime frame. The maximum value for the hitcount parameter is given by the 591320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci"ip_pkt_list_tot" parameter of the xt_recent kernel module. Exceeding this 601320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tuccivalue on the command line will cause the rule to be rejected. 611320f92c476a1ad9d19dba2a48c72b75566198e9Primiano Tucci.TP 626d86b77056ed63eb6871182f42a9fd5f07550f90Torne (Richard Coles)\fB\-\-rttl\fP 636d86b77056ed63eb6871182f42a9fd5f07550f90Torne (Richard Coles)This option may only be used in conjunction with one of \fB\-\-rcheck\fP or 646d86b77056ed63eb6871182f42a9fd5f07550f90Torne (Richard Coles)\fB\-\-update\fP. When used, this will narrow the match to only happen when the 655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)address is in the list and the TTL of the current packet matches that of the 66c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)packet which hit the \fB\-\-set\fP rule. This may be useful if you have problems 67c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)with people faking their source address in order to DoS you via this module by 685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)disallowing others access to your site by sending bogus packets to you. 695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles).PP 705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)Examples: 712a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles).IP 722a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)iptables \-A FORWARD \-m recent \-\-name badguy \-\-rcheck \-\-seconds 60 \-j DROP 735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles).IP 745821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)iptables \-A FORWARD \-p tcp \-i eth0 \-\-dport 139 \-m recent \-\-name badguy \-\-set \-j DROP 755821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles).PP 76c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)Steve's ipt_recent website (http://snowman.net/projects/ipt_recent/) also has 77c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)some examples of usage. 78c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles).PP 79c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)\fB/proc/net/xt_recent/*\fP are the current lists of addresses and information 80c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)about each entry of each list. 81c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles).PP 825d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)Each file in \fB/proc/net/xt_recent/\fP can be read from to see the current 83c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)list or written two using the following commands to modify the list: 84c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles).TP 85c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)\fBecho +\fP\fIaddr\fP\fB >/proc/net/xt_recent/DEFAULT\fP 86c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)to add \fIaddr\fP to the DEFAULT list 87c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles).TP 8890dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)\fBecho \-\fP\fIaddr\fP\fB >/proc/net/xt_recent/DEFAULT\fP 89c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)to remove \fIaddr\fP from the DEFAULT list 905821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles).TP 915821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)\fBecho / >/proc/net/xt_recent/DEFAULT\fP 925821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)to flush the DEFAULT list (remove all entries). 935821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles).PP 945821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)The module itself accepts parameters, defaults shown: 955821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles).TP 965821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)\fBip_list_tot\fP=\fI100\fP 97Number of addresses remembered per table. 98.TP 99\fBip_pkt_list_tot\fP=\fI20\fP 100Number of packets per address remembered. 101.TP 102\fBip_list_hash_size\fP=\fI0\fP 103Hash table size. 0 means to calculate it based on ip_list_tot, default: 512. 104.TP 105\fBip_list_perms\fP=\fI0644\fP 106Permissions for /proc/net/xt_recent/* files. 107.TP 108\fBip_list_uid\fP=\fI0\fP 109Numerical UID for ownership of /proc/net/xt_recent/* files. 110.TP 111\fBip_list_gid\fP=\fI0\fP 112Numerical GID for ownership of /proc/net/xt_recent/* files. 113