Hi,
Sorry for my english. I need a shell script. .
If IP make more than 300 connection attempts to port:80 within 10 seconds
I want block it for 3600 second in iptables.
Thank you ver much for help.
You normally would consider using apache or some other tool to block an ip. Are you trying to stop flooding?
I hardly think you need a shell script for this.
Even iptables is not a suitable solution for this and cannot handle this particular scenario.
The obvious approach would be a rule similar to this (snippet, not full chain):
iptables -A http_rule -m recent --update --name counter --seconds 10 --hitcount 300 -j do_something
However hitcount is limited to 20 on most recent kernels; any value larger than that will throw an error message since it cannot keep track of more than 20 connections.
This is -as far as I know- harcoded in the kernel and unless you load a custom module or use a non-stadard kernel it won't allow you to go beyond that number.
(300 conns / 10 seconds) is barely equal to (100 conns / 1 second) which is still much larger than 20; not useful.
Try other suggestions like using the tools provided by Apache or a more featured/robust firewall (a HW firewall perhaps, a routing ACL, etc).
Also, it would be more helpful if you explained what is the problem at hand that you're trying to solve instead of how you are trying to solve it.