Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Sorry to ask this question - but I have been browsing forums and threads on this subject and seem to confuse myself more than actually getting any clarity. All I need is a short and concise answer for this problem:

How do a setup a (chain) rule in iptables which rejects any source which fails to gain access to the server after XX attempts within YY minutes, so that any further attempt to contact the server is rejected before password is being matched for ZZ minutes. After ZZ minutes after the last attempt to connect, the rule must allow the same source to retry its attempt as if it had never attempted to reconnect before.

  • I assume this has to be written as a new chain rule.
  • I assume the chain rule has to be saved to iptables, so that the rule is resumed at reboot.
  • I assume the chain rule needs some kind of logging.

My problem is that I don't understand the iptables syntax disregarding how much I study it, and hence I'm grateful for the shortest "script type" answer on this question

share|improve this question
up vote 1 down vote accepted

Well, to be honest, there is a bit of a learning curve to iptables.

First, you can use ufw to start. ubw is a powerful command line tool and the advantage is the syntax is similar to iptables.

sudo ufw enable
sudo ufw limit 22

Here I am limiting port 22, you can use any port you wish.

Again the advantage is ufw will automate much of this and ease your learning process.

If you want to use iptables, you at a minimum need to learn to save and restore your rules.

sudo iptables-save > /etc/
sudo iptables-restore /etc/

You can edit /etc/, the syntax is straight forward enough.

When trying rules from remote, use iptables-apply to prevent a lockout

sudo iptables-apply /etc/

To restore your rules on boot, one of several methods is to add this to /etc/rc.local

iptables-restore /etc/

Other options listed in the Ubuntu iptables wiki page (see below).

The iptables syntax is

iptables -I INPUT -p tcp -m state --state NEW -m limit --limit 30/minute --limit-burst 5 -j ACCEPT

To LOG, add a LOG, but unless you are going to monitor your logs, use snort. logging iptables, IMO, is more helpful for debugging.

See man iptables, Ubuntu wiki iptables

Some people find my iptables web page helpful to start.

To answer your comment, see these rules

iptables -A INPUT -p tcp -m tcp --dport 22 -m tcp -m state --state NEW -m recent --set --name SSH --rsource

iptables -A INPUT -p tcp -m tcp --dport 22 -m recent --update --seconds 600 --hitcount 8 --rttl --name SSH --rsource -j DROP

iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT

The caveat is , it depends on the service. ssh is configured to allow so many attempts at password authentication 9see /etc/ssh/sshd_config ), so each connection gives 6 password attempts.

share|improve this answer
Thanks for your inputs - especially the link to your blog - I am not fully confident yet :-) When I translate my own question ("How to setup a chain rule in iptables...") I stil miss the following: :-$ iptables -I INPUT -p tcp -m state --state NEW -m limit --limit 30/minute --limit -burst 5 -j ACCEPT Here I assume that XX attempts = "-burst 5". But is "--limit 30/minute" the same as "YY minutes" i.e. the monitored time window? And I cannot figure out how "ZZ minutes" i.e. the penalty time for failure to validly connect, is present? – root-11 Dec 21 '11 at 17:53
There is an error in the answer, --limit -burst should be --limit-burst. I found the drawing in the Packet Filtering HOWTO the clearest visualization of how the limit module works. – Lekensteyn Dec 21 '11 at 18:22
Thank you, fixed. – bodhi.zazen Dec 21 '11 at 18:30
Have done a bit more homework and the solution doesn't do the job. I've added my problem child here in hope for a better idea. – root-11 Dec 28 '11 at 13:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.