India's only Computer Networking Institute by Corporate Trainers

IPT_RECENT with IPTables July 8, 2010

Well you know that iptables can be configured to block or allow certain hosts for certain services. That is fairly simple.

But we have a problem… ???

Suppose you have allowed SSH access to certain hosts (say x.x.x.x) and denied SSH access to certain hosts (say y.y.y.y) using iptables.. well that is done, no problem. But what will happen if hosts on y.y.y.y network spoof their IP’s to x.x.x.x range and then try to break in using some password cracking applications.

In the case iptables will simple give service to illegitimate hosts. OR another situation is — someone on x.x.x.x is trying to break the password using hit and trial or using some application. In the later case, even iptables will allow that hosts from x.x.x.x range the service prompt everytime he is trying to get in. 

Now this is DANGEROUS !! 

What is the solution ??

The solution is to use “IPT_RECENT” module with iptables. 

By using IPT_RECENT module with iptables you can restrict ANY IP for ANY SERVICE if the number of wrong hits exceeds your defined limit.

So, if a illegitimate user even from the allowed range x.x.x.x is trying to break in using some password breaking software, he will not be able to succeed. As after the certain number of “MISS HITS” his IP will be automatically PICKED by the iptables as a HOSTILE HOST and that service will automatically be BLOCKED for that HOST.

That’s enough talking…. now lets see how to configure IPT_RECENT with IPTables.

STEP #1 – Download IPT_RECENT module (it usually comes in tarball). You can download it from link given.

http://www.snowman.net/projects/ipt_recent/ipt_recent-0.3.1.tar.gz

STEP #2 – Gunzip the tarball

gunzip ipt_recent-0.3.1.tar.gz

STEP #3 - Extract the .tar file

tar -xvf ipt_recent-0.3.1.tar

STEP #4 – Load the module using modproble command

modprobe ipt_recent

STEP #5 - Configure the IPTables

iptables -N SSH_CHECK

iptables -I INPUT -p tcp –dport 22 -m state –state NEW -j SSH_CHECK

iptables -I SSH_CHECK -m state –state NEW -m recent –set –name SSH

iptables -I SSH_CHECK -m state –state NEW -m recent –update –seconds 60 –hitcount 4 –name SSH

iptables -I SSH_CHECK -m state –state NEW -m recent –rcheck –seconds 60 –hitcount 4 –name SSH -j DROP

STEP #6 - Save your configuration

service iptables save

STEP #7 - Reload the IPT_RECENT module

modprobe ipt_recent

STEP #8 - Make IPT_RECENT active after reboots. Put the entry in /etc/rc.d/rc.local file

modprobe ipt_recent

JOB IS DONE!!!

Enjoy your Intelligent Defense System.

God Bless.