I'm trying to figure out what these iptables rules actually do, but I am not very experienced.
These are the two rules:
iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 20 --connlimit-mask 16 -j REJECT --reject-with tcp-reset iptables -A INPUT -p tcp --syn --dport 443 -m connlimit --connlimit-above 20 --connlimit-mask 16 -j REJECT --reject-with tcp-reset
I've been trying to google this for myself, but I am not completely sure.
It is my understanding that these rules apply to incoming connections to the server using the TCP protocol on a specific port (HTTP and HTTPS in this case) and reject IP addresses that send more than 20 within a specific time period. But I don't understand what exactly the following attributes do or how REJECT actually works.
- --connlimit-above 20
- --connlimit-mask 16
- REJECT --reject-with tcp-reset
What is the time frame in which the limit applies to as do these IP addresses become blocked and if so for how long?