Limiting number of connections

Limiting number of connections

[Daniel Fenert]

Is there a simple way to limit number of connection coming from particular
client (ip address or subnet)?
I've searched through archive, and found only some patch to CVS version
of netfilter (it was year 2000)...

I've got problem with a few clients, they' are able to make 200+
connections on 128Kbit connection (according to /proc/net/ip_conntrack)

I thought about it today for a few minutes, and came with the idea:
1) Parse /proc/net/ip_conntrack and get clients with more than xxx
   connections
2) Setup rule to DROP NEW,RELATED to force them to close some connections
3) wait a minute, go to 1) checking additionally number of connections
   for blocked IP's. If number drops below xxx, delete rule DROP NEW,...
This is ugly, but possibly will work.

I hope that  there's better way to do it?

-- 
Daniel Fenert                 --==> daniel@fenert.net <==--
==-P o w e r e d--b y--S l a c k w a r e-=-ICQ #37739641-==
Is not that the nature of men and women -- that the pleasure is in the learning
of each other?        -- Natira, the High Priestess of Yonada, stardate 5476.3.

Re: Limiting number of connections

[Alex McCubbin]

I presume this is exactly what you are asking?

From... patch-o-matic/base/iplimit.patch.help 

Author: Gerd Knorr <kraxel@bytesex.org>
Status: ItWorksForMe[tm]

This adds CONFIG_IP_NF_MATCH_IPLIMIT match allows you to restrict the
number of parallel TCP connections to a server per client IP address
(or address block).

Examples:

# allow 2 telnet connections per client host
iptables -p tcp --syn --dport 23 -m iplimit --iplimit-above 2 -j REJECT

# you can also match the other way around:
iptables -p tcp --syn --dport 23 -m iplimit ! --iplimit-above 2 -j
ACCEPT

# limit the nr of parallel http requests to 16 per class C sized
# network (24 bit netmask)
iptables -p tcp --syn --dport 80 -m iplimit --iplimit-above 16		\
	--iplimit-mask 24 -j REJECT

Good luck - Alex.

On Fri, 2003-01-03 at 16:47, Daniel Fenert wrote:
> Is there a simple way to limit number of connection coming from particular
> client (ip address or subnet)?
> I've searched through archive, and found only some patch to CVS version
> of netfilter (it was year 2000)...
> 
> I've got problem with a few clients, they' are able to make 200+
> connections on 128Kbit connection (according to /proc/net/ip_conntrack)
> 
> I thought about it today for a few minutes, and came with the idea:
> 1) Parse /proc/net/ip_conntrack and get clients with more than xxx
>    connections
> 2) Setup rule to DROP NEW,RELATED to force them to close some connections
> 3) wait a minute, go to 1) checking additionally number of connections
>    for blocked IP's. If number drops below xxx, delete rule DROP NEW,...
> This is ugly, but possibly will work.
> 
> I hope that  there's better way to do it?

help Marking Packets

[hare ram]

Hi all

I have Home based network, running Good
i have Limited bandwidth to serve all the people

i want to give more preference to browsing and yahoo msn, mail

i want to restrict all downloads with low priority

how do i mark the packets of download and make them low priority or
i will allocate them only certain bandwidth

thanks
hare

Limiting number of connections

[Charlie Reitsma]

the iplimit patch applies easiest to protocol tcp...it leaves out udp. 
On my firewall the clients who are creating 200+ connections are using 
udp. I've seen examples of iplimit for udp but attempts to use
iptables -A INPUT -p udp -m iplimit --iplimit-above 80 -j DROP
results in "invalid argument." Being able to look at the connection 
table and limiting each source address to some number of entries is more 
like what one would expect of a module that limits the number of 
connections any client may create. I agree with Daniel that a script 
that adds/remove drop rules would work. Perhaps the script could make 
use of the "recent" module as discussed at 
http://www.stearns.org/doc/adaptive-firewalls.v0.1.html

Charlie
--------------
Alex wrote:
I presume this is exactly what you are asking?

From... patch-o-matic/base/iplimit.patch.help

Author: Gerd Knorr <kraxel@bytesex.org>
Status: ItWorksForMe[tm]

This adds CONFIG_IP_NF_MATCH_IPLIMIT match allows you to restrict the
number of parallel TCP connections to a server per client IP address
(or address block).

Examples:

# allow 2 telnet connections per client host
iptables -p tcp --syn --dport 23 -m iplimit --iplimit-above 2 -j REJECT

# you can also match the other way around:
iptables -p tcp --syn --dport 23 -m iplimit ! --iplimit-above 2 -j
ACCEPT

# limit the nr of parallel http requests to 16 per class C sized
# network (24 bit netmask)
iptables -p tcp --syn --dport 80 -m iplimit --iplimit-above 16		\
	--iplimit-mask 24 -j REJECT

Good luck - Alex.

On Fri, 2003-01-03 at 16:47, Daniel Fenert wrote:
 > Is there a simple way to limit number of connection coming from 
particular
 > client (ip address or subnet)?
 > I've searched through archive, and found only some patch to CVS version
 > of netfilter (it was year 2000)...
 >
 > I've got problem with a few clients, they' are able to make 200+
 > connections on 128Kbit connection (according to /proc/net/ip_conntrack)
 >
 > I thought about it today for a few minutes, and came with the idea:
 > 1) Parse /proc/net/ip_conntrack and get clients with more than xxx
 >    connections
 > 2) Setup rule to DROP NEW,RELATED to force them to close some connections
 > 3) wait a minute, go to 1) checking additionally number of connections
 >    for blocked IP's. If number drops below xxx, delete rule DROP NEW,...
 > This is ugly, but possibly will work.
 >
 > I hope that  there's better way to do it?