As I'm working on a tool to manage my firewalls, I stumbled on this answer:

Block SYN,ACK response with iptables

which include two lines of code like so:

# iptables -A INPUT -p tcp -m state --state NEW \
             -m recent --update --seconds 60 --hitcount 20 -j DROP
# iptables -A INPUT -p tcp -m state --state NEW -m recent --set -j ACCEPT

My concern is that the second line uses -j ACCEPT which opens the firewall 100% at that point. Rules appearing after that point will have no effect. For example, if I only wanted to open port 80 like so:

# iptables -A INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT
# iptables -A INPUT -j DROP

those two rules would be ignored.

So I see that as a potential security issue in the answer and someone who does not test their firewall thoroughly could end up with a really bad one.

Is there anything being done on this stack in such circumstances?

For now, I just posted a comment. I would imagine that's the best course of action I can use at the moment.

1 Answer 1


Comments are the best way to handle this. Hopefully, the one who posted the answer would correct the issues.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .