Re: iptables recent / more than one exception

"Paul W. Frields" <stickster@xxxxxxxxx> · Thu, 3 May 2012 13:46:48 -0400

On Thu, May 03, 2012 at 04:21:20PM +0200, Reindl Harald wrote:
> is there any way to specify here more than one source-address
> (the usual comma seperated way does not work in this context)
> 
> a complete ACCEPT before is no solution because it would bypass
> any selective ACCEPT-rule
> 
> iptables -I INPUT -p tcp -i eth0 ! -s $LOCAL_NETWORK -m state --state NEW -m recent --set
> iptables -I INPUT -p tcp -i eth0 ! -s $LOCAL_NETWORK -m state --state NEW -m recent --update --seconds 1 --hitcount  75 -j REJECT --reject-with tcp-reset

Even when you use comma-separated addresses (allowed when not using
the '!' operator), iptables actually creates separate rules in
response to the command.  I believe that's what you need to do in this
situation.

-- 
Paul W. Frields                                http://paul.frields.org/
  gpg fingerprint: 3DA6 A0AC 6D58 FEC4 0233  5906 ACDB C937 BD11 3717
  http://redhat.com/   -  -  -  -   http://pfrields.fedorapeople.org/
    The open source story continues to grow: http://opensource.com
-- 
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org