0

I need to limit access to some port per IP. Let's say 5 connections per minute - not more.

I've seen iptables recent, connlimit and limit, but all of them are not fitting exactly what I need.

Suppose you have a client trying to connect every second. In my scenario I need to allow 5 packets each minute.

recent: If some IP tries to connect every 1 second, --hitcount 5 will memorize this IP and keep it in the list until no packets comes within --second 60 time. So, it will limit the client permanently in my scenario.

limit: This one limits as I wish with --limit 5/min, but for all IPs - no way to specify this per IP.

connlimit: Limits number of simultaneous connections, not per some time.

In fact, I need a mixture of limit + recent. Who knows how to do it?

  • Why do you say that you can't "specify this per IP" for --limit? Of course you can do this. – Michael Hampton Jun 20 '14 at 17:00
  • @MichaelHampton - I think he's saying that he doesn't know the IP addresses the traffic will be coming from so he wants to dynamically specify the source IP address in the limit rule. – Evan Anderson Jun 20 '14 at 17:05
  • yes, incoming IP are unknown – PoltoS Jun 21 '14 at 22:12
2

I think that this is what you need to limit each source IP to a specified rate.

-m hashlimit --hashlimit-mode srcip --hashlimit-upto 5/min

Detailed examples are given in the URL's below.

http://www.mauromascia.com/blog/limiting-concurrent-connections-per-ip/?lang=it

http://etel.wiki.oreilly.com/wiki/index.php/SIP_DoS/DDoS_Mitigation

http://ipset.netfilter.org/iptables-extensions.man.html

  • Yikes. I'm losing my edge. You beat me to it by a few seconds. Histlimit is definitely what the OP wants. – Evan Anderson Jun 20 '14 at 17:17
  • Hm, never seen hashlimit while googling. But I don't understand how it works: iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m hashlimit --hashlimit-name SSH --hashlimit-mode srcip --hashlimit-above 5/min -j REJECT this call does not trap any command, while iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m hashlimit --hashlimit-name SSH --hashlimit-mode srcip --hashlimit 5/min -j REJECT traps all new connections... – PoltoS Jun 21 '14 at 22:41
  • Beware when you read the mauromascia.com site. Near the beginning when he talks about how connlimit isn't appropriate in his case, he is flat wrong. The connlimit rule he shows applies only to tcp packets with the SYN flag, which means new connections, which was all he was really trying to limit. He also presents a "solution" which includes several iptables rules that will never be matched, except by INVALID packets, which isn't what he wants. Note that I am not saying this answer is wrong - the OP's question here is well addressed by hashlimit. – Dan Pritts Jun 3 '15 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.