2

I want to limit connections per IP for a specific UDP port. I got it working for TCP, but somehow it doesn't work on UDP. These are my rules:

For TCP (working)

iptables -A INPUT -p tcp --syn --dport 7787 -m connlimit --connlimit-above 3 -j REJECT --reject-with tcp-reset
iptables -A INPUT -p tcp --syn --dport 7788 -m connlimit --connlimit-above 3 -j REJECT --reject-with tcp-reset

For UDP

iptables -A INPUT -p udp --dport 7787 -m connlimit --connlimit-above 3 -j REJECT
iptables -A INPUT -p udp --dport 7788 -m connlimit --connlimit-above 3 -j REJECT

According to the man pages this should work (atleast how I understand it), but I still get flooded by single IP's sometimes.

Improve this question

3 Answers 3

Reset to default
2

Your question doesn't make sense, as UDP doesn't really have "connections". There's only one conntrack entry that gets set up for each source IP/port.

Improve this answer
1
  • Thanks for your answer. I wasn't aware of that. What happends is that a client floods my gameserver with a lot of fake connections which fills up the server. Any other way to block this through iptables?
    – habl
    Apr 2, 2012 at 8:50
2

I think what you really wanted was something based around the hashlimit module.

Improve this answer
0

Well it sounds pretty much plausible that your client in question uses less than 3 NFCT connections to flood you.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .