Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know how to use limit conntrack option to allow for DoS protection. However, I want to add a protection to limit no more than say 50 connections for each port. How can I do this?

Basically, I want to make sure that each port can have no more than 50 connections, rather than globally applying 50 connections (which is what #2 does I believe?)

Would I do something like:

iptables -A INPUT --dport 1:65535 -m limit --limit 50/minute --limit-burst 50 -j ACCEPT


iptables -A INPUT -m limit --limit 50/minute --limit-burst 50 -j ACCEPT
share|improve this question
but you do know that this will limit both rouge and valid connections without distinguishing between them? – pQd Apr 11 '12 at 5:06
Yes, I think of it as something you add before you drop everything else – jersten Apr 11 '12 at 5:08
up vote 1 down vote accepted

You will be looking at the --hitcount switch.

--hitcount [hits]

match requiring a certain number of hits within a specific time frame. The maximum value for the hitcount parameter is given by the "ip_pkt_list_tot"

You will also be interested in the --seconds switch.

I believe a sample rule using port 80 and restricting connections to 50 per hour would be something like this:

iptables -I INPUT -p tcp --dport 80 -m state --state NEW -m recent --update --seconds 3600 --hitcount 50 -j DROP
share|improve this answer
If I was to substitute the dport 80 with 1:65535 does this mean each port has a maximum connection limit, or does the connection limit apply to all of the ports globally? – jersten Apr 11 '12 at 5:17
@user973917 Oops, sorry. I'm pretty sure that would limit the entire range, not each port within the range. =/ – Wesley Apr 11 '12 at 5:22
Thanks though, I've learned something new ;p – jersten Apr 11 '12 at 5:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.