dynamic iptables rules

slzckboy · 09-14-2005, 10:55 AM

scuse my ignorance.

I'm interested in only allowing a connection to my ident service(auth) only if i have recently connected to the site who is making the request.

Is there a way i can achieve this with iptables without just leaving the port open to responses from anywhere or statically assigning the source ip ?

thnks

rj

rjkfsm · 09-14-2005, 01:59 PM

Use the '-m state ESTABLISHED,RELATED' condition on that port.

If that doesn't suit your needs, check out recent matches at:
http://iptables-tutorial.frozentux.n...cent-match.txt

RK

slzckboy · 09-14-2005, 02:43 PM

Many thnks.

slzckboy · 09-15-2005, 11:38 AM

m state ESTABLISHED,RELATED dosn't suit my needs.

one thing....re the link.

Code:

iptables -A http-recent-final1 -p tcp -m recent --name httplist \
--tcp-flags SYN,ACK,FIN FIN,ACK --close -j ACCEPT

i can find no information on the "--close" switch in the man pages google etc..

can anyone explain?

thnks

slzckboy

slzckboy · 10-18-2005, 02:28 PM

this seems to work in that the irc server now advises that it got an ident response.

Code:

$IPTABLES -A OUTPUT -p tcp -s $NTL_IP -m tcp --dport 6667 -j recent-irc-connection
$IPTABLES -A INPUT -p tcp -m tcp --dport 113 -j recent-irc-connection

# recent-irc-connection chain.
$IPTABLES -N recent-irc-connection
#for output connections
$IPTABLES -A recent-irc-connection -s $NTL_IP -m recent --name irclist --set --rdest -j ACCEPT

#for input connections
$IPTABLES -A recent-irc-connection -s 0/0 -m recent --name irclist --rcheck -j ACCEPT