As far as how to put systems into the whitelist, that’s done by accessing some other resource on the same physical machine. It doesn’t matter if this is a different TCP (or even UDP) port or a different IP address (for a multi-homed machine or one that services multiple IPs via virtual hosting), or an out-of-band method such as a web server script that writes directly the IP address of the requestor to the appropriate file in “/proc/net/xt_recent/” or via e-mail to a special mailbox that extracts the address to write. The whitelist should use both the “–seconds” and “–rttl” features of the “recent” module to time out entries and help prevent source IP forgery (at least by comparing TTL values).

I have made the script you sent me available for download:
http://mwolf.net/misc-files/rc.firewall

It’s linked to from a new article:
http://mwolf.net/archive/firewall-script-from-scott/

This is my personal e-mail address you are receiving this from. I don’t give this one out to businesses or the like, only people I know. Please respect that and use meetscott@netscape.net if you want to distribute some correspondence to someone else. Thanks.

Cool! I’m very interested to see your improvements. If you don’t have a server to publish it on, feel free to use mine. If you prefer, you can mail it to me at “martin” at this domain, and I’ll publish it for you as a separate article.

In summary:
– I have a whitelist that is *not* limited by the number of login attempts.
– I have this hack presented here that limits the number of attempts from *all* other people for the 10 minute period, same as presented above.
– I have a blacklist, which is no longer being used but it’s still nice that I can use it if I change my mind.
– I close all ports except the ones I specify to open.
– And finally, I drop SYN packets which are inbound start up requests.
– Another note is that all the adjustable parts listed above are either set in variables at the top of the script or they are included in external files (eg the whitelist and blacklist). Open ports are in an easily editable list and the limiting ports are in an easily editable list at the top of the firewall script. So in order to open up another port, just add it to the list. To make a port limited to use per time, just add it to the LIMITED list. Once something has been adjusted, the firewall script just gets re-run. The ports are treated as a group so 3 ssh attempts, 2 ftp attempts, and then 1 pop3 attempt will trigger the 10 minute blocking (unless you’re on the whitelist of course

For now, I think this is all the functionality I have ever wanted out of iptables or a any other firewall for that matter. I’m thinking I might want to eventually adjust it for variables on the number of attempts, the time frame for those attempts, and then the blocking time.

If you’re interested I’ll post the script. Otherwise, I’ll likely post it on a how to once I get my own server co-located. Thanks for all the help.