Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i want to block ever ip addresses that have 50 connection per min . what am i going to do ? should i write a basic code ? Thanks in Advance .

share|improve this question

migrated from Nov 22 '10 at 19:37

This question came from our site for professional and enthusiast programmers.

Look at this Debian Administration article on rate limiting connections. Or look at this

share|improve this answer

I also had some brute attacks from a certain IP, here is how I blocked the IP via iptables.

(1) edit iptables

vi /etc/sysconfig/iptables

(2) add a line on the top of -A list (if you add it in the lower part, there is a chance it might not work because earlier conditions are met so the packets you are trying to block are still allowed to go through... I had this problem in the beginning and finally found the reason)


(3) restart iptables

/etc/init.d/iptables restart

That's it. Finally I don't see the connection messages in the server log anymore.

I also found people are saying to use 'fail2ban'. You may want to try it if there are multiple IPs (& changing) trying to connect to your server.

share|improve this answer

I think I had to install iptables from source to get the higher number of hits to work correctly..

-A INPUT -p tcp -m tcp -m state --state NEW -m recent --set --name TCPRATE --rsource
-A INPUT -p tcp -m tcp -m state --state NEW -m recent --update --seconds 60 --hitcount 50 --name TCPRATE --rsource -j LOG --log-prefix "TCP Rate Exceeded: "
-A INPUT -p tcp -m tcp -m state --state NEW -m recent --update --seconds 60 --hitcount 50 --name TCPRATE --rsource -j DROP
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.