How can I only allow TCP connections for 1 port using iptables on Unbantu? How can I also set a maximum packet on a connection?

Question

I'm running a server for public. I just want to allow TCP connections and I want to limit the packet to prevent ddosing a bit and setting a maximum IP/new connections per seconds with iptables. How can I do this?

Answer 1

To allow incoming traffic only on one port, you should set your default policy for the iptables chain INPUT to REJECT or DROP. Before that, you should at least allow tcp traffic on your ssh port (probably 22) so you don't lock yourself out.

iptables -A INPUT -p tcp --dport 22 -J ACCEPT
iptables -P INPUT DROP

If you want to limit the new connections to this port, you can use the state and the recent module. This line sets something like a log entry when you open a new connection to port 22.

iptables -I INPUT 1 -p tcp --dport 22 -m state --state NEW -m recent --set

This line checks how many "log entries" have been made in the last 60 seconds and if it's bigger than 2 (so the third new connection) it will drop the packets. It also updates the "log entry" so the sender is not able to open a new connection for the next 60 seconds and if he trys again it will update this timer again.

iptables -I INPUT 2 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 3 -j DROP

You should take care that those two lines are in top of the line that accepts the traffic to port 22 because iptables only uses the first line with ACCEPT, DROP or REJECT to decide if a packet should come through or not.