I'm having quite a difficult time figuring out how to REJECT both inbound and outbound connections from a machine with iptables once the total number of TCP connections hits a global maximum without respect to source or destination port. All sources/destinations/ports must be included.

Is this possible with iptables?

2 Answers 2

iptables -A INPUT -p tcp --syn -m connlimit --connlimit-above <your limit number> --connlimit-mask 0 -j DROP
iptables -A OUTPUT -p tcp --syn -m connlimit --connlimit-above <your limit number> --connlimit-mask 0 -j DROP
  • Thank you! I may have an opportunity to test this tonight and if it works well, I'll accept the answer! :) Oct 21, 2013 at 14:59
  • Works a treat, and (as should be obvious from the above) with iptables you can limit the total number of connections allowed in ANY chain, including input, output, and custom ones. Nov 4, 2013 at 21:31

you can do it using iptables module "connlimit"

/sbin/iptables -A INPUT -p tcp --syn --dport $port -m connlimit --connlimit-above N -j REJECT --reject-with tcp-reset


/sbin/iptables  -A INPUT -p tcp --syn --dport 22 -m connlimit --connlimit-above 3 -j REJECT
  • I'm looking for an absolute global limit, though, for the entire machine - not just a single port. Sep 18, 2013 at 16:40
  • --reject-with is only port 113 I guess? Also it's probably best not to reject INVALID packets?
    – x-yuri
    Aug 6, 2023 at 13:42
  • By the way, doesn't your answer lack --connlimit-mask 0 to limit the total number of connections?
    – x-yuri
    Aug 8, 2023 at 11:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .