<HTML><BODY><p style="margin-top: 0px;" dir="ltr">Hi Liviu,</p>
<p dir="ltr">thank you for an advice.<br> One more way to solve the problem (though I haven't tested yet) is using (if Linux) 'ipset' utility, adding flooding IP addresses there with options '-exist' and 'timeout'.</p>
<p dir="ltr">http://ipset.netfilter.org/ipset.man.html</p>
<div id="mail-app-auto-default-signature">
<p dir="ltr">--<br> Отправлено из Mail.Ru для Android</p>
</div>среда, 23 мая 2018г., 11:35 +05:00 от Liviu Chircu <a href="mailto:liviu@opensips.org">liviu@opensips.org</a>:<br><br><blockquote id="mail-app-auto-quote" style="border-left:1px solid #0857A6; margin:0px 0px 0px 10px; padding:0px 0px 0px 10px;" cite="15270573460000000255">
<div class="js-helper js-readmsg-msg">
<style type="text/css"></style>
<div >
<base target="_self" href="https://e.mail.ru/" />
<div id="style_15270573460000000255_BODY">Hi Alexey,<br>
<br>
You can extend the shell command with source IP listing/matching logic <br>
within iptables. For example:<br>
<br>
/usr/bin/sudo iptables -t filter -S INPUT | grep -q $si || (/usr/bin/sudo iptables -A INPUT -s $si -p udp -j DROP -m comment --comment 'blacklisted by OpenSIPS' && { echo \"/usr/bin/sudo iptables -D INPUT -s $si -p udp -j DROP -m comment --comment 'blacklisted by OpenSIPS'\" | at now + 5 min; })<br>
<br>
If the shell syntax gets too complex and the OpenSIPS script cannot handle it anymore, you should make a wrapper .sh around all the logic, and only feed it parameters.<br>
<br>
Best regards,<br>
<br>
Liviu Chircu<br>
OpenSIPS Developer<br>
<a href="http://www.opensips-solutions.com" target="_blank" >http://www.opensips-solutions.com</a><br>
<br>
On 23.05.2018 08:55, Alexey K. via Users wrote:<br>
> Hi all.<br>
><br>
> I use module pike.so and exec.so to automatically add flooding IP addresses to firewall rejecting rules.<br>
> The code is as follows:<br>
><br>
> pike_check_req();<br>
> switch($retcode) {<br>
> case -2: # detected once - simply drop the request<br>
> exit;<br>
> case -1: # detected again - ban the IP and drop request<br>
> exec("/usr/bin/sudo iptables -A INPUT -s $si -p udp -j DROP -m comment --comment 'blacklisted by OpenSIPS' && { echo \"/usr/bin/sudo iptables -D INPUT -s $si -p udp -<br>
> j DROP -m comment --comment 'blacklisted by OpenSIPS'\" | at now + 5 min; }");<br>
> exit;<br>
> }<br>
><br>
><br>
> Everything works fine, except that sometimes there are too much iptables entries are generated, which are the same:<br>
><br>
> root@deb-node-2:~# iptables -L INPUT -vn --line-numbers<br>
> Chain INPUT (policy ACCEPT 0 packets, 0 bytes)<br>
> num pkts bytes target prot opt in out source destination<br>
> 1 0 0 DROP udp -- * * 172.16.0.5 0.0.0.0/0 /* blacklisted by OpenSIPS */<br>
> 2 0 0 DROP udp -- * * 172.16.0.5 0.0.0.0/0 /* blacklisted by OpenSIPS */<br>
> 3 0 0 DROP udp -- * * 172.16.0.5 0.0.0.0/0 /* blacklisted by OpenSIPS */<br>
> ... ... ...<br>
> 87 0 0 DROP udp -- * * 172.16.0.5 0.0.0.0/0 /* blacklisted by OpenSIPS */<br>
><br>
><br>
> So I'm trying to understand what is the best way to generate only one iptables rule.<br>
> Is it possible to do with opensips, or the only way is to run some script which will look if there is already an iptables denying rule,<br>
> and if it's true, not to add one more rule.<br>
><br>
> -----------------------------------------------<br>
> BR, Alexey<br>
> <a href="http://alexeyka.zantsev.com/" target="_blank" >http://alexeyka.zantsev.com/</a><br>
> _______________________________________________<br>
> Users mailing list<br>
> <a href="mailto:Users@lists.opensips.org">Users@lists.opensips.org</a><br>
> <a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank" >http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
<br>
<br>
_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opensips.org">Users@lists.opensips.org</a><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank" >http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
</div>
<base target="_self" href="https://e.mail.ru/" />
</div>
</div>
</blockquote></BODY></HTML>