Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know how to use limit conntrack option to allow for DoS protection. However, I want to add a protection to limit no more than say 50 connections for each port. How can I do this?

Basically, I want to make sure that each port can have no more than 50 connections, rather than globally applying 50 connections (which is what #2 does I believe?)

Would I do something like:

iptables -A INPUT --dport 1:65535 -m limit --limit 50/minute --limit-burst 50 -j ACCEPT

or

iptables -A INPUT -m limit --limit 50/minute --limit-burst 50 -j ACCEPT
share|improve this question
    
but you do know that this will limit both rouge and valid connections without distinguishing between them? –  pQd Apr 11 '12 at 5:06
    
Yes, I think of it as something you add before you drop everything else –  josten Apr 11 '12 at 5:08
add comment

1 Answer 1

up vote 1 down vote accepted

You will be looking at the --hitcount switch.

--hitcount [hits]

match requiring a certain number of hits within a specific time frame. The maximum value for the hitcount parameter is given by the "ip_pkt_list_tot"

You will also be interested in the --seconds switch.

I believe a sample rule using port 80 and restricting connections to 50 per hour would be something like this:

iptables -I INPUT -p tcp --dport 80 -m state --state NEW -m recent --update --seconds 3600 --hitcount 50 -j DROP
share|improve this answer
    
If I was to substitute the dport 80 with 1:65535 does this mean each port has a maximum connection limit, or does the connection limit apply to all of the ports globally? –  josten Apr 11 '12 at 5:17
    
@user973917 Oops, sorry. I'm pretty sure that would limit the entire range, not each port within the range. =/ –  Wesley Apr 11 '12 at 5:22
    
Thanks though, I've learned something new ;p –  josten Apr 11 '12 at 5:24
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.