Problem with sample script "all-new-limit" on ubuntu 12.04 about iptables-boilerplate

[bmaeser]

sorry for the late reply, i was on vacation for 2 weeks.

where exactly did you find this number "20"? i did not run into any problems so far.

[taglia]

I got the warning when starting iptables. The error disappeared after reducing the number of connection to less than 20.

Might be a default configuration on Ubuntu 12.04.1 LTS, I installed iptables-boilerplate on a vanilla install of the distrib, on a linode.

[bmaeser]

i can not reproduce this error. would it be possible to share the error-message? thanks in advance.

[taglia]

Here you go:

root@dev:/etc/firewall/custom# service firewall reload
stopping firewall...firewall stopped
starting firewall...iptables: Invalid argument. Run `dmesg' for more information.
firewall startedroot@dev:/etc/firewall/custom# dmesg
...
xt_recent: hitcount (120) is larger than packets to be remembered (20)
root@dev:/etc/firewall/custom#

After changing CONNECTIONS=120 to CONNECTIONS=20 in "all-new-limit.sh", there are no errors:

root@dev:/etc/firewall/custom# service firewall reload
stopping firewall...
firewall stopped
starting firewall...
firewall started
root@dev:/etc/firewall/custom#

[bmaeser]

ok, i figured it out. its actually a setting of the xt_recent (called ipt_recent on some systems) kernel module.
you can change that by creating a ip_pkt_list_tot.conf file in /etc/modeprobe.d/ which contains:

options xt_recent ip_pkt_list_tot=120

this might be a problem on linode-hosts, since they do some kernel-space-sharing-stuff.

[bmaeser]

@taglia fyi: i added a hint on how to solve this issue to the comments on the top of the files. thanks for pointing out this problem.