noob question howto using iptables limit ip access times

noob question howto using iptables limit ip access times

[Zhu Jing]

hi ,all

 My aim is limit ip access to my squid server with 1000 times per day.
If this ip connections counts more then 1000,iptables will drop it.

 I have google a lot,and write a wired scripts :P

===========
    #!/bin/sh
   iptables -F
   iptables -X
   iptables -Z
   iptables -N squid
   iptables -A INPUT -p tcp --dport 80 -j squid
   iptables -A squid -m limit --limit 1/hour --limit-burst 1000 -j RETURN
   iptables -A squid -j DROP
   service iptables save
  service iptables restart
==========

   iptables -A squid -m limit --limit 1/hour --limit-burst 1000 -j RETURN

   IMO: this rule means ,the limit-burst token bucket is set to 1000
initially, for each hour token count goes up by 1, when token bucket
is empty---> not match --> go next rule
   But,  I tested it by using IE refresh my server , when i refresh
more then 7 or 8 times ,iptables going to drop my connections, why?

  CentOS4.6,kernel 2.6.9,iptables v1.3.5
  Im so sorry for my bad English,hope your understand what i was saying
  Any reply, webslink, experience ,doc and tools  are highly appreciable!!



  Regards

Re: noob question howto using iptables limit ip access times

[/dev/rob0]

On Mon, Jun 21, 2010 at 07:30:32PM +0800, Zhu Jing wrote:
> My aim is limit ip access to my squid server with 1000 times per day.
> If this ip connections counts more then 1000,iptables will drop it.
snip
>    iptables -A squid -m limit --limit 1/hour --limit-burst 1000 -j RETURN
> 
>    IMO: this rule means ,the limit-burst token bucket is set to 1000
> initially, for each hour token count goes up by 1, when token bucket
> is empty---> not match --> go next rule

No, the burst is the number of packets arriving at once. I think you 
want:
    iptables -A squid -m limit --limit 1000/day -j RETURN
optionally with a reasonable burst limit: --limit-burst 100

See also the more featureful connlimit and hashlimit matches. Perhaps 
-m recent might meet your need, too.
-- 
    Offlist mail to this address is discarded unless
    "/dev/rob0" or "not-spam" is in Subject: header

Re: noob question howto using iptables limit ip access times

[Pascal Hambourg]

Hello,

Zhu Jing a écrit :
> 
>  My aim is limit ip access to my squid server with 1000 times per day.
> If this ip connections counts more then 1000,iptables will drop it.
> 
>  I have google a lot,and write a wired scripts :P
> 
> ===========
>     #!/bin/sh
>    iptables -F
>    iptables -X
>    iptables -Z
>    iptables -N squid
>    iptables -A INPUT -p tcp --dport 80 -j squid
>    iptables -A squid -m limit --limit 1/hour --limit-burst 1000 -j RETURN
>    iptables -A squid -j DROP
>    service iptables save
>   service iptables restart
> ==========
> 
>    iptables -A squid -m limit --limit 1/hour --limit-burst 1000 -j RETURN
> 
>    IMO: this rule means ,the limit-burst token bucket is set to 1000
> initially, for each hour token count goes up by 1, when token bucket
> is empty---> not match --> go next rule
>    But,  I tested it by using IE refresh my server , when i refresh
> more then 7 or 8 times ,iptables going to drop my connections, why?

Because your rule limits packets, not connections. A single TCP
connection involves multiple packets.

Re: noob question howto using iptables limit ip access times

[Curby]

On Mon, Jun 21, 2010 at 6:02 AM, Pascal Hambourg
<pascal.mail@plouf.fr.eu.org> wrote:
> Because your rule limits packets, not connections. A single TCP
> connection involves multiple packets.

Yes, the stateful features of netfilter would be useful here.  Drop
the INVALIDs, accept the ESTABLISHED,RELATED, drop NEW not SYN
packets, and your match will mostly match valid new connection
attempts.  This could be further improved by detecting and dropping
port scans, as Jan wrote about.

This prevents the 1000/day rule from matching packets for ESTABLISHED
connections and for spurious packets that should be ignored.

--Mike

Re: noob question howto using iptables limit ip access times

[Zhu Jing]

On Mon, Jun 21, 2010 at 22:58, Curby <curby@cur.by> wrote:
>
> On Mon, Jun 21, 2010 at 6:02 AM, Pascal Hambourg
> <pascal.mail@plouf.fr.eu.org> wrote:
> > Because your rule limits packets, not connections. A single TCP
> > connection involves multiple packets.
>
> Yes, the stateful features of netfilter would be useful here.  Drop
> the INVALIDs, accept the ESTABLISHED,RELATED, drop NEW not SYN
> packets, and your match will mostly match valid new connection
> attempts.  This could be further improved by detecting and dropping
> port scans, as Jan wrote about.
>
> This prevents the 1000/day rule from matching packets for ESTABLISHED
> connections and for spurious packets that should be ignored.
>
> --Mike


  Thank your very much, ill try it later .Thx a lot