0

Currently my iptable is as follows to limit the number of concurrent connections per ip to 10 from any http client. However, I tried a simulated http test and I'm not getting dropped at all. what's wrong?

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [21:15123]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p tcp -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -m connlimit --connlimit-above 10 --connlimit-mask 32 -j REJECT --reject-with tcp-reset
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

2 Answers 2

1

This sounds to me like a bad idea. All you need is two or three browsers coming from the same ip (e.g. a corporate or home gateway), loading ordinary pages and images, and you'll start to get errors. The errors won't be too pretty, and will tend to generate support calls you don't want to have to deal with.

What you want to do is queue the requests, so that only a small number of worker processes or threads are active at once, so you don't exhaust your ram. Your web server software (eg apache our nginx) should do this for you given appropriate configuration; ask another question about that if necessary.

0

Rules are processed in order; rule 5 is an ACCEPT, before it even gets to your rate-limiting rules.

iptables -nvL will show you the counters for each rule and highlight the problem.

1
  • should I move rule 7 before 5
    – user12145
    Sep 11, 2014 at 3:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .