Iptables rule for ftp scanning

stefaandk · 02-22-2007, 12:55 AM

Getting hit with FTP scanners and I would like an iptables rule that for example only allows 1 attempt per minute.

Any way that iptables can do this?

Thanks.

////// · 02-22-2007, 01:13 AM

This should work

Code:

iptables -A INPUT -p tcp -i eth0 --dport 21 -m limit --limit 1/m --syn -j DROP

stefaandk · 02-22-2007, 01:26 AM

Thanks for the quick rsponse, one thing I need to add to this I just thought of is apply this rule if it comes from the same IP.

Otherwise I assume that I have 2 connections coming in in the same minute from different IP's it'll stop that as well?

stefaandk · 02-22-2007, 01:43 AM

I'm afraid that rule doesn't work though.

Just ran it and I opened a few FTP's simultaneously no problem.

And I am on eth0

Any suggestions, thanks.

stefaandk · 02-25-2007, 05:19 PM

I found a solution to this:

http://www.debian-administration.org/articles/187