I want to limit the number of TCP connections in Linux server, I have used the following command.

iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 25 --connlimit-mask 32 -j REJECT --reject-with tcp-reset

It seems like, something is wrong and desired results are not coming. I get the number of active connections using the following command

netstat -n | grep ':80' | awk -F' ' '{print $5}' | awk -F':' '{print$1}' | sort | uniq -c | sort -n

Now, When I type the above command, I get the following results.


As you can see there are more active tcp connections than allowed limit of 25. Can someone please help me with correct command , or What is going wrong in this ?

  • Its not the good way to do it. You should configure better your webserver. As your way will lead to bad user experience, as they will get connection problem with your site
    – yagmoth555
    Dec 8, 2014 at 11:16
  • 1
    Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n
    – HBruijn
    Dec 8, 2014 at 11:35
  • @yagmoth555 It's still a valid question, though. It might be a good idea to configure the webserver to send HTTP 503 at 20 connections per client, and also reject at 25 connections at the kernel level for stronger defense. Dec 8, 2014 at 11:36
  • I asked the same question in SO, and they sent me here. Someone down voted this question, I wonder why ?
    – Mani
    Dec 8, 2014 at 12:16
  • 1
    @Mani At a guess it was a, this is the wrong way to attack this problem downvote.
    – sysadmin1138
    Dec 8, 2014 at 12:33

2 Answers 2


Please see there; https://unix.stackexchange.com/questions/139285/limit-max-connections-per-ip-address-and-new-connections-per-second-with-iptable

Your line seem to limit to 25 the number per IP.

  • Thanks for your response, In fact I modified or did this task based on the thread link given by you. My problem is: It is not working. Or how do i verify that, It is working.
    – Mani
    Dec 9, 2014 at 4:51
  • @mani someone can correct me, but the rule, with syn, block 25 connection attemps, but when the connection is done, its no longer syn attempt.. you see my point?
    – yagmoth555
    Dec 9, 2014 at 12:30

There are 11 different states for a TCP connection and your iptables rule will limit the "SYN" state which is the right state for limiting TCP connections; but when you use "netstat" command, it will show you all the states that a connection went through. My point is that you did it right but you are checking it wrong. Pipe netstat command with your desire state which is "ESTABLISHED":

netstat -n | grep ESTABLISHED | grep ':80' | awk -F' ' '{print $5}' | awk -F':' '{print$1}' | sort | uniq -c | sort -n

Just a tip: you can use "netstat -ntp" to get only TCP connections.

Also check this, I think it's usefull.

Just for extra info; TCP connection states:

LISTEN: accepting connections

ESTABLISHED: connection up and passing data

SYN_SENT: session has been requested by us; waiting for reply from remote endpoint

SYN_RECV: session has been requested by a remote endpoint for a socket on which we were listening

LAST_ACK: our socket is closed; remote endpoint has also shut down; we are waiting for a final acknowledgement

CLOSE_WAIT: remote endpoint has shut down; the kernel is waiting for the application to close the socket

TIME_WAIT: socket is waiting after closing for any packets left on the network

CLOSED: socket is not being used

CLOSING: our socket is shut down; remote endpoint is shut down; not all data has been sent

FIN_WAIT1: our socket has closed; we are in the process of tearing down the connection

FIN_WAIT2: the connection has been closed; our socket is waiting for the remote endpoint to shut down

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.