Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

UFW's man page mentions that it can setup iptables rate limiting for me:

ufw supports connection rate limiting, which is useful for protecting against brute-force login attacks. ufw will deny connections if an IP address has attempted to initiate 6 or more connections in the last 30 seconds. See http://www.debian-administration.org/articles/187 for details. Typical usage is:

     ufw limit ssh/tcp

Unfortunately this is all the documentation that I could find. I would like to stick with UFW, and not use more complicated iptables commands (to keep things "uncomplicated").

How would I use ufw to limit all incoming (so not outgoing) traffic on port 80 to 20 connections per 30 seconds? How would I disable rate limiting for ports 30000 to 30005? Is rate limiting enabled by default for all ports?

share|improve this question

3 Answers 3

up vote 7 down vote accepted
+50

UFW is designed to be "uncomplicated," which in this case means you don't have control over the particulars of the rate to which connections are limited. If you want to dig into the Python source of UFW, you could find out how to tweak it. The appropriate information is (on my Ubuntu 10.04 system) in /usr/share/pyshared/ufw/backend_iptables.py

Setting the timing issue aside, therefore, here are some answers to your rapid-fire questions at the end.

  1. Assuming 10.10.10.0/24 is your local network, this applies the default limiting rule to port 80/tcp incoming:

    ufw limit proto tcp from any port 80 to 10.10.10.0/24
    
  2. and 3. Rate limiting is not turned on by default. To add it to every (destination) port except the range you want, use this rule. Note that rules (even with ranges) are atomic units and cannot be split up. You cannot, for example, add a rule for any port, then delete a (nonexistent) rule for a particular range to remove it. limit is not an acceptable argument to ufw default, either.

    ufw limit from any to any port 0:29999,30006:65535
    
share|improve this answer
    
Does this mean that the rate can never be set? –  Tom Apr 18 '12 at 9:16
1  
Not without hacking the source, at least not for UFW 0.30pre1-0ubuntu2, which is current for Ubuntu 10.04. From the look of things in the current source, that hasn't changed. You can, however put iptables rules into /etc/ufw/after.rules (or /etc/ufw/before.rules), and those will be used as well. See man ufw-framework for more info. –  bonsaiviking Apr 18 '12 at 11:37

rate limit can by changed on the ufw rules file which can be found /lib/ufw/user.rules. by default there are no limits enabled for all ports. you should add every port manualy or by editing user.rules file.

share|improve this answer

As mentioned on the previous post you can customize the user.rules. I need my smtp connection rate limit of up to 12 connections in 6 seconds. I added a rule as shown below first. Note: this adds a limit rule allowing 6 in 30 sec by default

ufw limit smtp

and I edited the /lib/ufw/user.rules (I keep a custom copy of this file with lot of other tweaks) as shown below ...

### tuple ### limit tcp 25 0.0.0.0/0 any 0.0.0.0/0 in
-A ufw-user-input -p tcp --dport 25 -m state --state NEW -m recent --set
-A ufw-user-input -p tcp --dport 25 -m state --state NEW -m recent --update --seconds 6 --hitcount 12 -j ufw-user-limit
-A ufw-user-input -p tcp --dport 25 -j ufw-user-limit-accept
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.