iptables limit module request

[Masterman]

Hi,

There are some major security concerns regarding Proftpd (as well as other WAN accessible ports) and hacker/bot hammering. If you have the time to compile an ipt_limit.ko module for Kernel 2.6.24.111 to allow for the use of the limit parameter, I, and many others, would greatly appreciate it!

Thanks,

Masterman

[BrainSlayer]

this is already compiled into the kernel. no module required

[Masterman]

Hi,

Thanks for the reply.

What build changeset did this occur in? I'm running 14144 mega, and the module is not present:

# ls -l /lib/modules/2.6.24.111/kernel/net/netfilter

total 65

-rw-r--r-- 1 root root 42508 Jan 2 12:29 nf_conntrack_h323.ko

-rw-r--r-- 1 root root 7700 Jan 2 12:29 nf_conntrack_pptp.ko

-rw-r--r-- 1 root root 6100 Jan 2 12:29 nf_conntrack_proto_gre.ko

-rw-r--r-- 1 root root 2952 Jan 2 12:29 xt_connmark.ko

-rw-r--r-- 1 root root 2672 Jan 2 12:29 xt_mac.ko

-rw-r--r-- 1 root root 2476 Jan 2 12:29 xt_mark.ko

# iptables -I INPUT 2 -p tcp -i $wanf --dport 21 -m state --state NEW -m limit --limit 3/min -j

# echo $? 255

Here is my rc_firewall, and the logs indicate that the limit rule is not functioning:

wanf=nvram get wan_iface

iptables -I INPUT 2 -p tcp -i $wanf --dport 21 -j logdrop

iptables -I INPUT 2 -p tcp -i $wanf --dport 21 -m state --state NEW -m limit --limit 3/min -j logaccept

iptables -I INPUT 2 -p tcp -i $wanf -j asia

iptables -I FORWARD 1 -i $wanf -p tcp --dport 20:1024 -j asia

iptables -D FORWARD iptables --line-numbers -nL FORWARD | grep ESTABLISHED | tail -n1 | awk '{print $1}'

iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

Please re-review this problem as many users are wanting it fixed.

Thanks again,

Masterman

[Masterman]

Also, there is an ebt_limit.ko, but no ipt_limit.ko:

root@Asus:/lib/modules/2.6.24.111/kernel/net/bridge/netfilter# ls

ebt_802_3.ko ebt_arpnat.ko ebt_ip.ko ebt_mark_m.ko ebt_snat.ko ebtable_broute.ko ebtables.ko ebt_among.ko ebt_arpreply.ko ebt_limit.ko ebt_pkttype.ko ebt_stp.ko ebtable_filter.ko ebt_arp.ko ebt_dnat.ko ebt_mark.ko ebt_redirect.ko ebt_vlan.ko ebtable_nat.ko root@Asus:/lib/modules/2.6.24.111/kernel/net/bridge/netfilter#

[BrainSlayer]

you should maybe tell first that you're talking about the broadcom build. the module is also not named ipt_limit. its xt_limit

[BrainSlayer]

by the way. it affects only the 2.6 kernel, but not 2.4 broadcom builds. its fixed now

[Masterman]

Thanks Brainslayer. Sorry if I didn't include the necessary information regarding the kernel change difference between ipt_limit and xt_limit..

Once again, many thanks,

Masterman

[Masterman]

One small favor Brainslayer, if it's not too much to ask. I realize you are incorporating this into the next build, but could you upload the module to the DD-WRT FTP database please? If not my email is lmacdowe@…

It's not listed in here:

http://www.dd-wrt.com/site/support/other-downloads?path=others%2Feko%2FPublic%2Fmodules%2F2.6.24.111%2F

Thanks man, much appreciated,

Masterman