Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to limit the the number of connections to my Ubuntu server to no more than 10 in the most recent 50 seconds for any individual IP. I am trying to do this with iptables. I have never configured or entered any iptables command before. The commands fail thusly:

# /sbin/iptables -I INPUT -p tcp --dport 80 -i venet0:0 -m state --state NEW -m recent --set
iptables: No chain/target/match by that name.
# /sbin/iptables -I INPUT -p tcp --dport 80 -i venet0:0 -m state --state NEW -m recent --update --seconds 50 --hitcount 10 -j "DROP"
iptables: No chain/target/match by that name.

venet0:0 is indeed an interface:

# ifconfig | head -20
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:160410 errors:0 dropped:0 overruns:0 frame:0
          TX packets:160410 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:10303872 (10.3 MB)  TX bytes:10303872 (10.3 MB)

venet0    Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:127.0.0.2  P-t-P:127.0.0.2  Bcast:0.0.0.0  Mask:255.255.255.255
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1
          RX packets:63699988 errors:0 dropped:0 overruns:0 frame:0
          TX packets:44836148 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:61862863168 (61.8 GB)  TX bytes:4519224195 (4.5 GB)

venet0:0  Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:*.*.*.*  P-t-P:*.*.*.*  Bcast:0.0.0.0  Mask:255.255.255.255
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1
share|improve this question
    
Does any iptables command work? If not, then you need to look at your kernel config to ensure netfilter works properly. See this SO question for details. –  Nathan C Aug 14 '13 at 14:48
    
venet0:0 doesn't appear to have an ip address associated with it. –  symcbean Aug 14 '13 at 15:08
    
It does. I purposely obscured it. –  JoeyJoeJoeJuniorShabadoo Aug 14 '13 at 15:26

1 Answer 1

up vote 0 down vote accepted

use this format instead, assuming ..*.* is the ip address for venet0:0

-i venet0 -d *.*.*.*
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.