iPhone OS 11_3 http connection flood

Question

I have been trying to limit max TCP connections to port 80 of my server coming from the same IP. I have used iptables for this task:

-A INPUT -p tcp --dport 80 -m conntrack --ctstate ESTABLISHED -m connlimit --connlimit-above 24 --connlimit-mask 32 -j LOG_THROT

The rule sends packets to my LOG_THROT chain where I log them and tcp reset the connection.

The problem is that all the IP's that get logged (overflooding 24 parallel http connection rule) and get found in apache's access logs seem legit users with referrals from google, coming from standard mobile ISP's like vodafone etc. What they all got in common is User agent and it is:

Mozilla/5.0 (iPhone; CPU iPhone OS 11_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/ 11.0 Mobile/15E148 Safari/604.1

I was wondering if the new OS/Browser has a higher limit than standard 6 parallel conns, does it maybe use some kind of preloading of the links found on the website and spawns additional connections or is it a crawler of some sort spoofing the UA?

If it is legit, what do you suggest for a safe connection count limit? 50, 100?

Answer 1

Why don't you tune your web and use HTTP/2 (eventual HTTPS)

They both use single, multiplexed connection, instead of multiple connections in HTTP1.x Domain sharding techniques are not needed any more.

Answer 2

Got this solved. The answer differs from the best solution though. The best solution is the answer by prosti.

What is happening is that the aforementioned Safari/iOS doesn't reuse keep-alive connection. The reasons for this may be many and internet is riddled with different answers on this topic, might even be a deprected feature in their latest versions. Apple forums were useless on this topic.

So for every asset it has to load from the website it spawns a new connection but server keeping the conns alive for X amount of seconds eventually hits the threshold from the iptables rule.

Solution that helped me was to add BrowserMatch directive in httpd.conf which matches all iphone/ipod devices and turns off keepalive support for them.

BrowserMatch "iPhone|iPad|iPod" nokeepalive

as far for the max connections Safari can spawn I have found documented that in some erroneus situation it will go as high as 15000 !! ( https://www.wiktorzychla.com/2017/06/http2-keep-alive-and-safari-browsers.html ). But in normal circumstances it will be more along the values 4-8 per domain or 15-30 sharding judging by this stats: http://www.browserscope.org/?category=network&ua=Safari*&v=3