What are these iptables rules?

Question

I'm trying to figure out what these iptables rules actually do, but I am not very experienced.

These are the two rules:

iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 20 --connlimit-mask 16 -j REJECT --reject-with tcp-reset
iptables -A INPUT -p tcp --syn --dport 443 -m connlimit --connlimit-above 20 --connlimit-mask 16 -j REJECT --reject-with tcp-reset

I've been trying to google this for myself, but I am not completely sure.

It is my understanding that these rules apply to incoming connections to the server using the TCP protocol on a specific port (HTTP and HTTPS in this case) and reject IP addresses that send more than 20 within a specific time period. But I don't understand what exactly the following attributes do or how REJECT actually works.

• --syn
• --connlimit-above 20
• --connlimit-mask 16
• REJECT --reject-with tcp-reset

What is the time frame in which the limit applies to as do these IP addresses become blocked and if so for how long?

Answer 1

Below are the meanings of those arguments in the above iptables rules.

--syn

This is actually short for --tcp-flags SYN,RST,ACK,FIN SYN and says that for the packets being examined by this iptables rule, TCP flags SYN, RST, ACK and FIN should be checked. Only packets with the TCP flag SYN set should be matched.

--connlimit-above 20

This is actually part of the argument -m connlimit --connlimit-above 20 and says to match packets to the connection limit. If packets are related to any connection in excess of the first 20 connections then drop the packets.

--connlimit-mask 16

This allows you to restrict which subnet masks the packets are originating from will be allowed. This argument translates into only limit the number of connections to 16 for each 255.255.0.0 subnet. So by using the two together you are controlling how many connections can be made from a 255.255.0.0 subnet at one time.

REJECT --reject-with tcp-reset

This says that any packet that matches should be dropped. By telling iptables to drop the packet with tcp-reset you are saying that the originating source has to start the conversation over (and if they make the same request it will also be deinied).

http://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO-7.html

http://ipset.netfilter.org/iptables-extensions.man.html

Answer 2

Could not add a comment sine did not have reputation, tho have one note to add related to :

--connlimit-above 16

means, if the number of existing ESTABLISHED connections from the same ip address is above 16.