diff --git a/doc/debian_build_doc.md b/doc/debian_build_doc.md index 27792b2ce..fbfe721fb 100644 --- a/doc/debian_build_doc.md +++ b/doc/debian_build_doc.md @@ -98,10 +98,21 @@ REGISTRAR_CODE="test" SECONDS=60 # Max connections per IP BLOCKCOUNT=100 +# Source specification. Address can be either a network name, a hostname, a network IP address +# (with /mask), or a plain IP address. Hostnames will be resolved once only, before the rule +# is submitted to the kernel. Please note that specifying any name to be resolved with +# a remote query such as DNS is a really bad idea. The mask can be either a network mask or +# a plain number, specifying the number of 1's at the left side of the network mask. +# Thus, a mask of 24 is equivalent to 255.255.255.0. A "!" argument before +# the address specification inverts the sense of the address. +# The flag --src is an alias for this option. Multiple addresses can be specified, +# but this will expand to multiple rules (when adding with -A), +# or will cause multiple rules to be deleted (with -D). +REGISTRAR_HANDLE_SOURCE = 'x.x.x.x' # default action can be DROP or REJECT or something else. DACTION="REJECT" $IPT -A INPUT -p tcp --dport 700 -i eth0 -m state --state NEW -m recent --set -$IPT -A INPUT -p tcp --dport 700 -m recent --name $REGISTRAR_CODE --rdest --rcheck --hitcount ${BLOCKCOUNT} --seconds ${SECONDS} -j ${DACTION} +$IPT -A INPUT -p tcp --dport 700 -s $REGISTRAR_HANDLE_SOURCE -m recent --name $REGISTRAR_CODE --rdest --rcheck --hitcount ${BLOCKCOUNT} --seconds ${SECONDS} -j ${DACTION} ```` After adding iptable counters, please add correct permissions to proc files at path /proc/net/xt_recent