I want to make a script that sees if a number of connection attempts are made from one or more IPs (
$CT_MULTIPLE_IP_THRESHOLD) in an ammount of time (
$CT_TIME). If this happens, than in that ammount of time (
$CT_TIME), search through all IPs and ban those that exceed the maximum number of allowed trials for one IP (
I have found the
recent module which semms to be able to achieve this.
iptables -A INPUT -m recent --name port_multiple_scan --rcheck --hitcount $CT_SINGLE_IP_THRESHOLD --seconds $CT_TIME -j DROP
Q1: How can I do the threshold for multiple IPs (the hitcount can be used only with
Q2: Can I do a ban IP (let's say in hosts.deny) instead of -j DROP?
Q3: Is there a betterm module (instead of
recent)to use and how?