3

I am following iptables connection limits to limit the amount of connections the server can get on port 80. For instance I tried:

/sbin/iptables -I INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 10 -j REJECT --reject-with tcp-reset

This seems to limit connections per IP. Is there any way to via IPTables or perhaps sysctl to limit the connection amount globally. Meaning that if say host A jams up all of the 10 available sessions then no other host will be able to connect?

Improve this question
1
  • I know you are asking about IPTables/sysctl but just in case you hadn't thought of it, you can do this at the web server level too, in Apache/Nginx config etc.
    – JayMcTee
    Jun 17, 2015 at 11:04

1 Answer 1

Reset to default
4

You can modify your rule by adding the option --connlimit-mask 0. This effectively enables you to limit connections globally and all IPs will be treated without any distinction.

On the contrary, the default value 32 for IPv4 means to match every single IP alone.

As suggested by @JayMcTee, you can use web server level solution to limit connections limit. For example, you can look at MaxClients option for apache.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .