Skip to content

Instantly share code, notes, and snippets.

@mrizvic
Created July 13, 2015 06:34
Show Gist options
  • Save mrizvic/d24233efc76dfdcb9433 to your computer and use it in GitHub Desktop.
Save mrizvic/d24233efc76dfdcb9433 to your computer and use it in GitHub Desktop.
iptables trick for client to send multiple tcp-syn to connect to service
iptables -N LEVEL1
iptables -N LEVEL2
iptables -N LEVEL3
iptables -N CHECKIN
iptables -N WELCOME
iptables -F LEVEL1
iptables -F LEVEL2
iptables -F LEVEL3
iptables -F CHECKIN
iptables -F WELCOME
iptables -A LEVEL1 -j LOG --log-prefix "Ohai1: "
iptables -A LEVEL1 -p tcp -m tcp --dport 22 -m recent --set --name LEVEL1 --rsource -j DROP
iptables -A LEVEL2 -j LOG --log-prefix "Ohai2: "
iptables -A LEVEL2 -m recent --remove --name LEVEL1 --rsource
iptables -A LEVEL2 -p tcp -m tcp --dport 22 -m recent --set --name LEVEL2 --rsource -j DROP
iptables -A LEVEL2 -j LEVEL1
iptables -A LEVEL3 -j LOG --log-prefix "Ohai3: "
iptables -A LEVEL3 -m recent --remove --name LEVEL2 --rsource
iptables -A LEVEL3 -p tcp -m tcp --dport 22 -m recent --set --name LEVEL3 --rsource -j DROP
iptables -A LEVEL3 -j LEVEL1
iptables -A CHECKIN -m recent --rcheck --seconds 10 --name LEVEL3 --rsource -j OHAI
iptables -A CHECKIN -m recent --rcheck --seconds 10 --name LEVEL2 --rsource -j LEVEL3
iptables -A CHECKIN -m recent --rcheck --seconds 10 --name LEVEL1 --rsource -j LEVEL2
iptables -A CHECKIN -j LEVEL1
iptables -A OHAI -j LOG --log-prefix "Ohai successful: "
iptables -A OHAI -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
iptables -A OHAI -j LEVEL1
iptables -I INPUT 1 -i eth0 -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j CHECKIN
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment