limit connections

[Marcus Schopen]

Hi Bron,

I have a user, who logs in every 3 seconds(!) to pop3s with 20 accounts,
completely resistent to change his pop interval. I'd like to limit him
in the way to allow 20 new connections within 5 minutes, then block his
IP for 5 minutes (he is using a static IP) and open the port after five
minutes again. I tried the following rule, but that opens the port only
if the client keeps quiet and doesn't connect while the block is set.

Example:

iptables -A INPUT -p tcp -m tcp --dport 995 -m state --state NEW -m
recent --set --name pop3s --rsource

iptables -A INPUT -p tcp -m tcp --dport 995 -m state --state NEW -m
recent --rcheck --seconds 300 --hitcount 20 --name pop3s --rsource -j
REJECT --reject-with icmp-port-unreachable

I know this is off topic and not cyrus specific, but any help would be
great.

cyrus: 2.4.17 on Ubuntu 14.04 LTS.

Ciao
Marcus