I have a web server that uses a additional restful server in a different port. I would like to allow traffic to the restful server only after a connection to the main server has been established. To accomplish that I use the following rules
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3001 -m recent --set --name P1 --mask 255.255.255.255 --rsource
-A INPUT -p tcp -m tcp --dport 8000 -m recent --rcheck --seconds 1000 --name P1 --mask 255.255.255.255 --rsource -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8000 -m state --state NEW -j DROP
-A INPUT -p tcp -m tcp --dport 8001 -m recent --rcheck --seconds 1000 --name P1 --mask 255.255.255.255 --rsource -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8001 -m state --state NEW -j DROP
A connection is allowed to port 8000 / 8001 only if a connection on 3001 has already been established.
The thing is that the scheme breaks down after three connections to port 8000.
Does the –rcheck somehow deletes the IP from the P1 list?
Am I doing something incorrectly?
