# [SOLVED] iptables --hitcount gives Invalid argument

## ipic

I'm trying to get iptables set up to reject excessive connections on a given port. I've searched around this forum, and the wiki, and got very close. Just one problem remains, and I wonder if anyone can just give me the nudge that would finish this off please.

So, the problem. I am trying to set up these rules:

```

iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --name "limit-80" --set

iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --name "limit-80" --rcheck --seconds 120 --hitcount 30 -j LOG --log-prefix "limit-reject-80 "
```

With the "--hitcount 30" parameter included, I get "iptables: Invalid argument" every time.

If I take it out, the rule is accepted - but not very useful:

```

iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --name "limit-80" --rcheck --seconds 120 -j LOG --log-prefix "limit-reject-80 "
```

To get here, I have made sure that all netfilter options in the kernel configuration are compiled in (ie not modules). The relevant output from zcat /proc/config.gz is at the end - the only item not configured is IP_NF_QUEUE, and the Kernel configurer says that this is obsolete

```
Symbol: IP_NF_QUEUE [=n]                                                │  

  │ Prompt: IP Userspace queueing via NETLINK (OBSOLETE)
```

 so I assume that can't be the problem.

I have emerged iptables with no use flags set:

```

ian2 ~ # emerge -pv net-firewall/iptables

These are the packages that would be merged, in order:

Calculating dependencies... done!

[ebuild   R   ] net-firewall/iptables-1.3.8-r3  USE="-extensions -imq -ipv6 -l7filter -static" 0 kB 

Total: 1 package (1 reinstall), Size of downloads: 0 kB

```

I have tried to compile iptables with the various use flags set, but it fails every time suggesting that I patch the kernel. I *really* don't want to do that, maintenance nightmare. I did make sure that I recompiled iptables after the kernel parameters were changed.

Any ideas?

Thanks

Ian

The relevant kernel parameters:

```

#

# IP: Netfilter Configuration

#

CONFIG_NF_CONNTRACK_IPV4=y

CONFIG_NF_CONNTRACK_PROC_COMPAT=y

# CONFIG_IP_NF_QUEUE is not set

CONFIG_IP_NF_IPTABLES=y

CONFIG_IP_NF_MATCH_RECENT=y

CONFIG_IP_NF_MATCH_ECN=y

CONFIG_IP_NF_MATCH_AH=y

CONFIG_IP_NF_MATCH_TTL=y

CONFIG_IP_NF_MATCH_ADDRTYPE=y

CONFIG_IP_NF_FILTER=y

CONFIG_IP_NF_TARGET_REJECT=y

CONFIG_IP_NF_TARGET_LOG=y

CONFIG_IP_NF_TARGET_ULOG=y

CONFIG_NF_NAT=y

CONFIG_NF_NAT_NEEDED=y

CONFIG_IP_NF_TARGET_MASQUERADE=y

CONFIG_IP_NF_TARGET_REDIRECT=y

CONFIG_IP_NF_TARGET_NETMAP=y

CONFIG_NF_NAT_SNMP_BASIC=y

CONFIG_NF_NAT_PROTO_GRE=y

CONFIG_NF_NAT_FTP=y

CONFIG_NF_NAT_IRC=y

CONFIG_NF_NAT_TFTP=y

CONFIG_NF_NAT_AMANDA=y

CONFIG_NF_NAT_PPTP=y

CONFIG_NF_NAT_H323=y

CONFIG_NF_NAT_SIP=y

CONFIG_IP_NF_MANGLE=y

CONFIG_IP_NF_TARGET_ECN=y

CONFIG_IP_NF_TARGET_TTL=y

CONFIG_IP_NF_TARGET_CLUSTERIP=y

CONFIG_IP_NF_RAW=y

CONFIG_IP_NF_ARPTABLES=y

CONFIG_IP_NF_ARPFILTER=y

CONFIG_IP_NF_ARP_MANGLE=y

# CONFIG_IP_DCCP is not set

CONFIG_IP_SCTP=m

# CONFIG_SCTP_DBG_MSG is not set

# CONFIG_SCTP_DBG_OBJCNT is not set

# CONFIG_SCTP_HMAC_NONE is not set

# CONFIG_SCTP_HMAC_SHA1 is not set

CONFIG_SCTP_HMAC_MD5=y

# CONFIG_TIPC is not set

# CONFIG_ATM is not set

CONFIG_BRIDGE=m

CONFIG_VLAN_8021Q=m

# CONFIG_DECNET is not set

CONFIG_LLC=m

# CONFIG_LLC2 is not set

# CONFIG_IPX is not set

# CONFIG_ATALK is not set

# CONFIG_X25 is not set

# CONFIG_LAPB is not set

# CONFIG_ECONET is not set

# CONFIG_WAN_ROUTER is not set

# CONFIG_NET_SCHED is not set

CONFIG_NET_CLS_ROUTE=y

```

Last edited by ipic on Tue May 06, 2008 8:35 pm; edited 1 time in total

----------

## ipic

More fiddling around and I have the answer.

Its not the --hitcount parameter that's causing the problem, its the value of the --hitcount parameter.

Any value over 20 gives "Invalid argument".

So, I can adjust to "--seconds=60 --hitcount=15" and I get what I want, and the commands work.

Odd thing, this iptables. Why choose 20 as a limit? 16 or 32 I'd understand, but 20 is just odd   :Shocked: 

Regards

Ian

----------

