iptables -A FORWARD -m recent --name badguy --rcheck --seconds
60 -j DROP
iptables -A FORWARD -p tcp -i eth0 --dport 139 -m recent --name
badguy --set -j DROP
Steve’s ipt_recent website (http://snowman.net/projects/ipt_recent/)
also has some examples of usage.
/proc/net/ipt_recent/* are the current lists of addresses and informa‐
tion about each entry of each list.
Each file in /proc/net/ipt_recent/ can be read from to see the current
list or written two using the following commands to modify the list:
echo +addr >/proc/net/ipt_recent/DEFAULT
to add addr to the DEFAULT list
echo -addr >/proc/net/ipt_recent/DEFAULT
to remove addr from the DEFAULT list
echo / >/proc/net/ipt_recent/DEFAULT
to flush the DEFAULT list (remove all entries).