I have been trying to limit max TCP connections to port 80 of my server coming from the same IP. I have used iptables for this task:
-A INPUT -p tcp --dport 80 -m conntrack --ctstate ESTABLISHED -m connlimit --connlimit-above 24 --connlimit-mask 32 -j LOG_THROT
The rule sends packets to my LOG_THROT chain where I log them and tcp reset the connection.
The problem is that all the IP's that get logged (overflooding 24 parallel http connection rule) and get found in apache's access logs seem legit users with referrals from google, coming from standard mobile ISP's like vodafone etc. What they all got in common is User agent and it is:
Mozilla/5.0 (iPhone; CPU iPhone OS 11_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/ 11.0 Mobile/15E148 Safari/604.1
I was wondering if the new OS/Browser has a higher limit than standard 6 parallel conns, does it maybe use some kind of preloading of the links found on the website and spawns additional connections or is it a crawler of some sort spoofing the UA?
If it is legit, what do you suggest for a safe connection count limit? 50, 100?