1

I want to limit the number of TCP connections in Linux server, I have used the following command.

iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 25 --connlimit-mask 32 -j REJECT --reject-with tcp-reset

It seems like, something is wrong and desired results are not coming. I get the number of active connections using the following command

netstat -n | grep ':80' | awk -F' ' '{print $5}' | awk -F':' '{print$1}' | sort | uniq -c | sort -n

Now, When I type the above command, I get the following results.

44 122.179.103.8
45 107.167.107.123
46 120.60.76.201
48 122.162.172.182
49 183.87.48.105
51 122.161.241.33
71 198.72.112.97
98 122.168.167.114
103 122.177.169.21
134 106.51.130.193
137 122.165.226.196

As you can see there are more active tcp connections than allowed limit of 25. Can someone please help me with correct command , or What is going wrong in this ?

  • Its not the good way to do it. You should configure better your webserver. As your way will lead to bad user experience, as they will get connection problem with your site – yagmoth555 - GoFundMe Monica Dec 8 '14 at 11:16
  • 1
    Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n – HBruijn Dec 8 '14 at 11:35
  • @yagmoth555 It's still a valid question, though. It might be a good idea to configure the webserver to send HTTP 503 at 20 connections per client, and also reject at 25 connections at the kernel level for stronger defense. – 200_success Dec 8 '14 at 11:36
  • I asked the same question in SO, and they sent me here. Someone down voted this question, I wonder why ? – Mani Dec 8 '14 at 12:16
  • 1
    @Mani At a guess it was a, this is the wrong way to attack this problem downvote. – sysadmin1138 Dec 8 '14 at 12:33
0

Please see there; https://unix.stackexchange.com/questions/139285/limit-max-connections-per-ip-address-and-new-connections-per-second-with-iptable

Your line seem to limit to 25 the number per IP.

  • Thanks for your response, In fact I modified or did this task based on the thread link given by you. My problem is: It is not working. Or how do i verify that, It is working. – Mani Dec 9 '14 at 4:51
  • @mani someone can correct me, but the rule, with syn, block 25 connection attemps, but when the connection is done, its no longer syn attempt.. you see my point? – yagmoth555 - GoFundMe Monica Dec 9 '14 at 12:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.