2

I'm trying to figure out what these iptables rules actually do, but I am not very experienced.

These are the two rules:

iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 20 --connlimit-mask 16 -j REJECT --reject-with tcp-reset
iptables -A INPUT -p tcp --syn --dport 443 -m connlimit --connlimit-above 20 --connlimit-mask 16 -j REJECT --reject-with tcp-reset

I've been trying to google this for myself, but I am not completely sure.

It is my understanding that these rules apply to incoming connections to the server using the TCP protocol on a specific port (HTTP and HTTPS in this case) and reject IP addresses that send more than 20 within a specific time period. But I don't understand what exactly the following attributes do or how REJECT actually works.

  • --syn
  • --connlimit-above 20
  • --connlimit-mask 16
  • REJECT --reject-with tcp-reset

What is the time frame in which the limit applies to as do these IP addresses become blocked and if so for how long?

5

Below are the meanings of those arguments in the above iptables rules.

--syn

This is actually short for --tcp-flags SYN,RST,ACK,FIN SYN and says that for the packets being examined by this iptables rule, TCP flags SYN, RST, ACK and FIN should be checked. Only packets with the TCP flag SYN set should be matched.

--connlimit-above 20

This is actually part of the argument -m connlimit --connlimit-above 20 and says to match packets to the connection limit. If packets are related to any connection in excess of the first 20 connections then drop the packets.

--connlimit-mask 16

This allows you to restrict which subnet masks the packets are originating from will be allowed. This argument translates into only limit the number of connections to 16 for each 255.255.0.0 subnet. So by using the two together you are controlling how many connections can be made from a 255.255.0.0 subnet at one time.

REJECT --reject-with tcp-reset

This says that any packet that matches should be dropped. By telling iptables to drop the packet with tcp-reset you are saying that the originating source has to start the conversation over (and if they make the same request it will also be deinied).

http://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO-7.html

http://ipset.netfilter.org/iptables-extensions.man.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.