3

I am following iptables connection limits to limit the amount of connections the server can get on port 80. For instance I tried:

/sbin/iptables -I INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 10 -j REJECT --reject-with tcp-reset

This seems to limit connections per IP. Is there any way to via IPTables or perhaps sysctl to limit the connection amount globally. Meaning that if say host A jams up all of the 10 available sessions then no other host will be able to connect?

1
  • I know you are asking about IPTables/sysctl but just in case you hadn't thought of it, you can do this at the web server level too, in Apache/Nginx config etc.
    – JayMcTee
    Jun 17 '15 at 11:04
4

You can modify your rule by adding the option --connlimit-mask 0. This effectively enables you to limit connections globally and all IPs will be treated without any distinction.

On the contrary, the default value 32 for IPv4 means to match every single IP alone.

As suggested by @JayMcTee, you can use web server level solution to limit connections limit. For example, you can look at MaxClients option for apache.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.