Re: [OT?] inverted `limit' match support in iptables/netfilter

[Patrick Dreker <patrick@dreker.de>]

Am Montag, 15. Januar 2001 23:06 schrieb Alexander Hvostov:
> Hello,
>
> I'm trying to get the `limit' match support in iptables/netfilter to be
> inverted in the sense that it only matches when the limit has been
> exceeded. For instance, to log a flood:
>
> iptables -I INPUT -m limit ! --limit 1/s -j LOG
>
> However, for some reason, the `!' flag does not seem to change the
> behavior of the limit match module, and it continues to match until the
> limit is exceeded.
Try doing it this way (in a separate chain):

iptables -A limitexceeded -m limit --limit 1/s -j ACCEPT (or DROP or whatever)
iptables -A limitexceeded -j LOG

untested, but should do the trick.

> Does anyone have any ideas or solutions?
> Regards,
> Alex.

-- 
Patrick Dreker
---------------------------------------------------------------------
> Is there anything else I can contribute?
The latitude and longtitude of the bios writers current position, and
a ballistic missile.        
                         Alan Cox on linux-kernel@vger.kernel.org