Iptables Tutorial 1.2.2

ОглавлениеДобавить в закладки К обложке

Recent match

The recent match is a rather large and complex matching system, which allows us to match packets based on recent events that we have previously matched. For example, if we would see an outgoing IRC connection, we could set the IP addresses into a list of hosts, and have another rule that allows identd requests back from the IRC server within 15 seconds of seeing the original packet.

Before we can take a closer look at the match options, let's try and explain a little bit how it works. First of all, we use several different rules to accomplish the use of the recent match. The recent match uses several different lists of recent events. The default list being used is the DEFAULT list. We create a new entry in a list with the set option, so once a rule is entirely matched (the set option is always a match), we also add an entry in the recent list specified. The list entry contains a timestamp, and the source IP address used in the packet that triggered the set option. Once this has happened, we can use a series of different recent options to match on this information, as well as update the entries timestamp, et cetera.

Finally, if we would for some reason want to remove a list entry, we would do this using the --remove match option from the recent match. All rules using the recent match, must load the recent module (-m recent) as usual. Before we go on with an example of the recent match, let's take a look at all the options.

Table 10-27. Recent match options

Match --name
Kernel 2.4, 2.5 and 2.6
Example iptables -A OUTPUT -m recent --name examplelist
Explanation The name option gives the name of the list to use. Per default the DEFAULT list is used, which is probably not what we want if we are using more than one list.
Match --set
Kernel 2.4, 2.5 and 2.6
Example iptables -A OUTPUT -m recent --set
Explanation This creates a new list entry in the named recent list, which contains a timestamp and the source IP address of the host that triggered the rule. This match will always return success, unless it is preceded by a ! sign, in which case it will return failure.
Match --rcheck
Kernel 2.4, 2.5 and 2.6
Example iptables -A OUTPUT -m recent --name examplelist --rcheck
Explanation The --rcheck option will check if the source IP address of the packet is in the named list. If it is, the match will return true, otherwise it returns false. The option may be inverted by using the ! sign. In the later case, it will return true if the source IP address is not in the list, and false if it is in the list.
Match --update
Kernel 2.4, 2.5 and 2.6
Example iptables -A OUTPUT -m recent --name examplelist --update
Explanation This match is true if the source combination is available in the specified list and it also updates the last-seen time in the list. This match may also be reversed by setting the ! mark in front of the match. For example, ! --update.
Match --remove
Kernel 2.4, 2.5 and 2.6
Example iptables -A INPUT -m recent --name example --remove
Explanation This match will try to find the source address of the packet in the list, and returns true if the packet is there. It will also remove the corresponding list entry from the list. The command is also possible to inverse with the ! sign.
Match --seconds
Kernel 2.4, 2.5 and 2.6
Example iptables -A INPUT -m recent --name example --check --seconds 60
Explanation This match is only valid together with the --check and --update matches. The --seconds match is used to specify how long since the "last seen" column was updated in the recent list. If the last seen column was older than this amount in seconds, the match returns false. Other than this the recent match works as normal, so the source address must still be in the list for a true return of the match.
Match --hitcount
Kernel 2.4, 2.5 and 2.6
Example iptables -A INPUT -m recent --name example --check --hitcount 20
Explanation The --hitcount match must be used together with the --check or --update matches and it will limit the match to only include packets that have seen at least the hitcount amount of packets. If this match is used together with the --seconds match, it will require the specified hitcount packets to be seen in the specific timeframe. This match may also be reversed by adding a ! sign in front of the match. Together with the --seconds match, this means that a maximum of this amount of packets may have been seen during the specified timeframe. If both of the matches are inversed, then a maximum of this amount of packets may have been seen during the last minumum of seconds.
Match --rttl
Kernel 2.4, 2.5 and 2.6
Example iptables -A INPUT -m recent --name example --check --rttl
Explanation The --rttl match is used to verify that the TTL value of the current packet is the same as the original packet that was used to set the original entry in the recent list. This can be used to verify that people are not spoofing their source address to deny others access to your servers by making use of the recent match.
Match --rsource
Kernel 2.4, 2.5 and 2.6
Example iptables -A INPUT -m recent --name example --rsource
Explanation The --rsource match is used to tell the recent match to save the source address and port in the recent list. This is the default behavior of the recent match.
Match --rdest
Kernel 2.4, 2.5 and 2.6
Example iptables -A INPUT -m recent --name example --rdest
Explanation The --rdest match is the opposite of the --rsource match in that it tells the recent match to save the destination address and port to the recent list.

I have created a small sample script of how the recent match can be used, which you can find in the Recent-match.txt section.


-= 150 =-
Регистрация.
Забыли пароль?
Логин
Пароль
Запомнить меня