Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I would like to set a maximum limit for the number of connections that can be made to Apache from a single external IP address.

What would be the best way to achieve this?

Thanks

share|improve this question

2 Answers 2

up vote 6 down vote accepted

I believe that mod_qos is probably going to be the answer to your prayers. I can't provide any specific configuration or recommendations, because I've never actually used it, but it comes with all the knobs you're likely to need.

More generally, iptables is more than capable of handling this sort of thing itself, and it's a far better solution (do networky stuff at the networky level). This is especially true if you want to deal with other protocols as well as HTTP, or only want to apply the limits to a subset of connections.

The iptables command you want is something like

iptables -I INPUT -p tcp --dport 80 -m state --state NEW -m recent --name http --update --seconds 1 --hitcount 5 -j REJECT
iptables -I INPUT -p tcp --dport 80 -m state --state NEW -m recent --name http --set

This will limit incoming connections to 5 per second.

Note, however, that connection limiting can be a real pain for legitimate users who just happen to be heavy users of the site, and it'll only slow down attackers that really aren't a concern anyway. Use with caution.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.