Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want to limit the number of ALL incoming NEW connections on a port, not only from one IP, something like:

iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m limit --limit 3/s -j DROP

But I don't understand what's wrong. It worked once/twice, tried different limits and after that it now drops all new connections. (yes, I flushed the iptables each time before adding the rule in its various forms).

EDIT1: I have tried

iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 5 --hitcount 5 --name SSH -j DROP

and it seems to work. Will this affect all connections or only the ones from the same IP?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

If you want to limit the number of new connections to 3/s, you have to change the rule target to be ACCEPT instead of DROP:

iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m limit --limit 3/s -j ACCEPT

You can read from man iptables:

limit
   This module matches at a limited rate using a token bucket filter.
   A rule using this extension will match until this limit is reached

So, your rule will drop all new connections until the limit is reached!!!

share|improve this answer
    
I have tried the rule you gave me and it seems it doesn't do what I want. I have tested it like this: for ($i = 0; $i < 10; $i++) { $f = fsockopen("IP_HERE", 22, &$err, &$err2, 1); echo "Opening #$i: ".($f ? "OK" : "FAILED, timeout 1s")."<br>"; } And it instantly creates 10 connections, when it should have created only 3 per second, right? –  Shocker Apr 10 '12 at 14:49
    
@Shocker: You need to create a DROP rule after this, or have the default INPUT policy set to DROP depending on your rules config. Otherwise, all connections will be accepted. –  Khaled Apr 10 '12 at 14:55
    
You are right, thank you –  Shocker Apr 10 '12 at 15:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.