iptables and firewall coonfiguration so thatit understand when ssh logs in properly and when not

Hello everyone,
if you know how to use iptables (v 1.3.3) read on - i have slackware
10.2 btw:

basically i have a little home network and i have forwarded port 22 to
my linux machine in there both from internal network and from computers
from the internet..
but checking out /var/log/messages i see that ppl just dont stop trying
to connect to my pc.
therefore i want to start using rc.firewall. so i generated an
rc.firewall script with Easy Firewall Generator.. put in /etc/rc.d set
the right permissions and started using it...
basically so far this is the code i have written:

$IPT -A tcp_inbound -p TCP -s ! 192.168.0.0/24 --destination-port 22 -m
recent --update --seconds 300 -j DROP
$IPT -A tcp_inbound -p TCP -s ! 192.168.0.0/24 -m state --state NEW
--destination-port 22 -m recent --set -j ACCEPT

which basically says:
first pass:
line 1: if there is inbound tcp connection with source port outside my
home network on port 22 AND the recent flag has been set, update its
timestamp to current time and wait 300secs before reseting the flag.
also DROP the packets. sincein the 1st pass the 'recent' flag hasnt
been set, the rule will not be executed and packets will not be
dropped.
line 2: if there is NEW inbound tcp connection with source port outside
my home network on port 22 , set the 'recent' flag and accept the
packet. so an ssh login appears.

2nd pass:
line 1: if there is inbound tcp connection with source port outside my
home network on port 22 AND the recent flag has been set, update its
timestamp to current time and wait 300secs before reseting the flag
also DROP the packets. since in the 2nd pass the 'recent' flag has been
set (from line 2 , 1st pass), the rule will be executed and packets
will be dropped. so i won't get a login screen.
so far so good... and that works wonders for attacks that try to
connect to me through ssh (basically this is what i set out initially
to do)

however, if say i login and logout straight away, and try to login
again, i will not be able to. i basically, somehow, if i DO manage to
login to ssh, the 'recent' flag to be reset. so i can login again...
how is it possible to do that?
nass

On 9 Nov 2006 14:56:52 -0800, "nass" <(E-Mail Removed)> wrote:

>however, if say i login and logout straight away, and try to login
>again, i will not be able to. i basically, somehow, if i DO manage to
>login to ssh, the 'recent' flag to be reset. so i can login again...
>how is it possible to do that?
>nass

man iptables:

Each file in /proc/net/ipt_recent/ can be read from to see the current list or
written two using the following commands to modify the list:

echo xx.xx.xx.xx > /proc/net/ipt_recent/DEFAULT
to Add to the DEFAULT list

echo -xx.xx.xx.xx > /proc/net/ipt_recent/DEFAULT
to Remove from the DEFAULT list

echo clear > /proc/net/ipt_recent/DEFAULT
to empty the DEFAULT list.

Try the second option from successful login?

Grant.
--
http://bugsplatter.mine.nu/