#Syntax for the PORTFLOOD setting:#PORTFLOOD is a comma separated list of:port;protocol;hit count*;interval seconds#So, a setting of PORTFLOOD = "22;tcp;5;300,80;tcp;20;5" means:#1. If more than 5 connections to tcp port 22 within 300 seconds, then block#that IP address from port 22 for at least 300 seconds after the last packet is#seen, i.e. there must be a "quiet" period of 300 seconds before the block is#lifted#2. If more than 20 connections to tcp port 80 within 5 seconds, then block#that IP address from port 80 for at least 5 seconds after the last packet is#seen, i.e. there must be a "quiet" period of 5 seconds before the block is#lifted

################################################################################ Copyright 2006-2017, Way to the Web Limited# URL: http://www.configserver.com# Email: [email protected]################################################################################ The following IP addresses will be blocked in iptables# One IP address per line# CIDR addressing allowed with a quaded IP (e.g. 192.168.254.0/24)# Only list IP addresses, not domain names (they will be ignored)## Note: If you add the text "do not delete" to the comments of an entry then# DENY_IP_LIMIT will ignore those entries and not remove them## Advanced port+ip filtering allowed with the following format# tcp/udp|in/out|s/d=port|s/d=ip## See readme.txt for more information regarding advanced port filtering#