Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In my network, there is a machine which has to make a http request towards a server which is beyond a firewall.

This machine's ip address (as seen from beyond the firewall) can be chosen from a pool of about 5 addresses.

Every ip can execute a maximum number of requests per day, after that, it can't be used again till the next day; the time interval between two requests doesn't matter, as long as the daily limit is not reached.

I would like to configure the firewall's routing table so that, from the client machine, I can make http requests without worrying about the time interval between them. My only concern should be the total daily limit (i.e. number of ips * max requests per ip).

I tried something like:

iptables -m hashlimit -m tcp -A POSTROUTING --syn --hashlimit-name x --hashlimit <MAX REQUESTS>/day -p tcp -s <CLIENT IP> -d <SERVER IP> --dports 80 --to-source <ONE OF THE IPs TO CHOOSE FROM>

And repeated that command for all of the five ips (with a final rule that drops further connection attempts).

But with this configuration I can't do requests in bursts. For example, if MAX_REQUESTS is 9000, i cannot make 9000 requests in the first two minutes, because the hashlimit module deals with averages, and stops matching a rule as soon as the packets' count is above the specified average. Therefore with this configuration I can use that ip only once every 9.6 seconds (=86400/9000): not what I want.

So I'm asking for suggestions about a possible iptables rule (or something else) which would allow me to perform requests in bursts and stay within the daily limit.

Thanks for your time

Silvio

EDIT: I have tried using --hashlimit-burst N, but this parameter only inserts a tolerance for the first N packets, i.e. adds N packets which can match the rule regardless of the average, after which the normal conditions apply. Again, not what I want.

UPDATE: The current candidate iptable command I'm using is

iptables -m hashlimit -m multiport -m tcp -A POSTROUTING -t nat --syn --hashlimit-name NAME --hashlimit MAX_REQUEST/day -p tcp -s SOURCE_IP -d DESTINATION_IP --dports 80 -j SNAT --to-source ONE_OF_THE IPs

It still has the above mentioned problem (can't send packets in bursts).

share|improve this question
add comment

1 Answer 1

For tight control, I'd try something along the lines of:

iptables -t nat -A POSTROUTING -s INT_SRC -d EXT_SERVICE --syn --limit MAXREQ/day -j SNAT --to-source EXT_IP1
...

(then I find that's what you already tried :p)

How about using:

iptables -t nat -A POSTROUTING -s INT_SRC -d EXT_SERVICE --syn -j SNAT --to-source EXT_IP_RANGE

Apparently that variant uses a simple round-robin algorithm - I'd try that. I hope your external IPs are in a single range :)


Can't just let further requests fail on their own? Given that you have very specific requirements, I'd probably:

  • add a --log to the rule
  • write a daemon that keeps track of the number of service connections made that day and inserts a rule into the FORWARD that drops further connections to that service
  • have the daemon remove that rule (if present) at midnight and reset its connection count

There doesn't seem to be anything that already exists to handle exactly what you want to do.

share|improve this answer
    
I forgot the -j SNAT option, thanks for reminding me. I've put up the updated version of the command I'm using. Also, doing round robin on a single range of IPs is an useful suggestion, I will consider this option in the final solution. Anyway, I would still like to drop requests when the limit is reached, auto-limiting my client's ability to connect to the outside server, so my ideal situation would be a rule (or a set of rules) that match under the limit, and a final rule that matches over the limit and drops packets –  Silvio Donnini Jul 20 '10 at 8:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.