I am using a rather restrictive firewall on my machine, mostly to block potential port scanning. If any IP address sends me a unsolicited packet (packet that is not a response to my query) the IP address gets blocked for X minutes.
-A INPUT -i wlan0 -m recent --name PORTSCAN --update --seconds 300 -j DROP
-A INPUT -i wlan0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i wlan0 -m recent --name PORTSCAN --set -j DROP
This rule never blocks legitimate websites. The only "legitimate" website that gets blocked are the stackexchange websites.
This happens constantly. I did not have time to investigate further, but the problem must be on your side, because I don't get these problems anywhere else.
Is your website scanning peoples machines ?
Recent Inbox Messages
resp.Recent Achievents: ...
ever change (red backgrounded number, +10/20 etc green highlight)? If not you seem to be blocking unsolicited updates of your page that are based on other peoples actions (upvoting, commenting).--ctstate RELATED,ESTABLISHED
is standard iptables rule. Anybody who is interested can test it himself.--update
rule must be first, to drop the already blacklisted IP addresses. Only clean IP addresses get to the second line and get a chance to pass the RELATED,ESTABLISHED test. I don't understand the "recent module" internals (I have not studied the code), but I understand what the rule does.