PORTFLOOD not working with hitcount > 20
Posted: 24 Nov 2015, 08:45
Hi there,
We know that the iptables module involved with hitcount (xt_recent) by default only supports 20 number of packets per IP address to remember, but as per its documentation, this value can be set up to 255:
This change is done by loading the module specifying the value for each parameter (either manually with modprobe or through /etc/modprobe.d/xt_recent.conf):
or
Having done this, you can see that iptables xt_recent module values are correctly loaded:
But even with an upper hitcount value, CSF is not calling PORTFLOOD chain from INPUT CHAIN. We found that CSF script /etc/csf/csf.pl has harcoded hitcount to a max of 20:
If you change this hardcoded check to the value taken from /sys/module/xt_recent/parameters/ip_pkt_list_tot, then CSF is properly creating the iptables INPUT call to PORTFLOOD CHAIN.
So maybe the script should read the max hitcount value by reading /sys/module/xt_recent/parameters/ip_pkt_list_tot instead of hardcoding it? Or is there any reason to hardcode it? If so, could you please elaborate in order to understand this behaviour?
Thank you for your great software and kind regards.
We know that the iptables module involved with hitcount (xt_recent) by default only supports 20 number of packets per IP address to remember, but as per its documentation, this value can be set up to 255:
Code: Select all
parm: ip_pkt_list_tot:number of packets per IP address to remember (max. 255) (uint); 20 by defaultCode: Select all
modprobe xt_recent ip_list_tot=3000 ip_pkt_list_tot=100Code: Select all
cpaneldev:~# vi /etc/modprobe.d/xt_recent.conf
options xt_recent ip_list_tot=3000 ip_pkt_list_tot=100
# Then stopping iptables, unloading all modules and starting it againCode: Select all
cpaneldev:~# cat /sys/module/xt_recent/parameters/ip_pkt_list_tot
100Code: Select all
$ vi /etc/csf/csf.pl
(...)
if (($count < 1) or ($count > 20))
(...)So maybe the script should read the max hitcount value by reading /sys/module/xt_recent/parameters/ip_pkt_list_tot instead of hardcoding it? Or is there any reason to hardcode it? If so, could you please elaborate in order to understand this behaviour?
Thank you for your great software and kind regards.