* rate limits
@ 2014-01-19 2:43 Nick Edwards
2014-01-19 4:01 ` Phil Oester
0 siblings, 1 reply; 4+ messages in thread
From: Nick Edwards @ 2014-01-19 2:43 UTC (permalink / raw)
To: Netfilter user mailing list
Hi,
We have some rate limits on port 80 only, they work as intended
(almost) and we are happy with the outcome (almost)
So now, the " almost"'s
We obviously do not want to limit our lan, but our lan is affected..
I'm sure its an out of order rule, but here goes :->
/usr/sbin/iptables -F
/usr/sbin/ip6tables -F
/usr/sbin/iptables -X
/usr/sbin/ip6tables -X
/usr/sbin/iptables -P INPUT ACCEPT
/usr/sbin/iptables -P OUTPUT ACCEPT
/usr/sbin/iptables -P FORWARD DROP
/usr/sbin/ip6tables -P INPUT ACCEPT
/usr/sbin/ip6tables -P OUTPUT ACCEPT
/usr/sbin/ip6tables -P FORWARD DROP
/usr/sbin/iptables -A INPUT -i lo -j ACCEPT
/usr/sbin/ip6tables -A INPUT -i lo -j ACCEPT
/usr/sbin/ip6tables -A INPUT -s fe80::/10 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -d ff00::/8 -j ACCEPT
/usr/sbin/iptables -A INPUT -s 199.x.x.x/22 -j ACCEPT
/usr/sbin/iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
/usr/sbin/ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
..some other rules for other ports...
/usr/sbin/iptables -I INPUT -p tcp --dport 80 -m state --state NEW -m
recent --set
/usr/sbin/iptables -I INPUT -p tcp --dport 80 -m state --state NEW -m
recent --update --seconds 5 --hitcount 2 -j DROP
/usr/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
/usr/sbin/iptables -A INPUT -p tcp --dport 1:1023 -j DROP
We obviously dont want our 199.x.x.x/22 limited but it is, I thought
being before this rule, it would be immune, also, if we use localhost,
it too is limited, I guess its because we use -I which inserts at top
of rules, but if we used -A in the two recent rule lines we found it
didnt always work at all?
any suggestions?
Thanks
Nik
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: rate limits
2014-01-19 2:43 rate limits Nick Edwards
@ 2014-01-19 4:01 ` Phil Oester
2014-01-19 20:49 ` Neal Murphy
0 siblings, 1 reply; 4+ messages in thread
From: Phil Oester @ 2014-01-19 4:01 UTC (permalink / raw)
To: Nick Edwards; +Cc: Netfilter user mailing list
On Sun, Jan 19, 2014 at 12:43:56PM +1000, Nick Edwards wrote:
> Hi,
> We have some rate limits on port 80 only, they work as intended
> (almost) and we are happy with the outcome (almost)
>
> /usr/sbin/iptables -A INPUT -i lo -j ACCEPT
> /usr/sbin/ip6tables -A INPUT -i lo -j ACCEPT
> /usr/sbin/ip6tables -A INPUT -s fe80::/10 -j ACCEPT
> /usr/sbin/ip6tables -A INPUT -d ff00::/8 -j ACCEPT
>
> /usr/sbin/iptables -A INPUT -s 199.x.x.x/22 -j ACCEPT
> /usr/sbin/iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
> /usr/sbin/ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
>
> ..some other rules for other ports...
>
> /usr/sbin/iptables -I INPUT -p tcp --dport 80 -m state --state NEW -m
> recent --set
> /usr/sbin/iptables -I INPUT -p tcp --dport 80 -m state --state NEW -m
> recent --update --seconds 5 --hitcount 2 -j DROP
> /usr/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
>
> /usr/sbin/iptables -A INPUT -p tcp --dport 1:1023 -j DROP
>
> We obviously dont want our 199.x.x.x/22 limited but it is, I thought
> being before this rule, it would be immune, also, if we use localhost,
> it too is limited, I guess its because we use -I which inserts at top
> of rules, but if we used -A in the two recent rule lines we found it
> didnt always work at all?
>
> any suggestions?
Yes, don't use -I to insert the limit rules at the very top of the INPUT
chain. But if you insist upon doing so, exempt your LAN from the rules
by adding "-s ! 199.x.x.x/22" to the two recent rules.
Phil
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: rate limits
2014-01-19 4:01 ` Phil Oester
@ 2014-01-19 20:49 ` Neal Murphy
2014-01-22 2:00 ` Nick Edwards
0 siblings, 1 reply; 4+ messages in thread
From: Neal Murphy @ 2014-01-19 20:49 UTC (permalink / raw)
To: netfilter
On Saturday, January 18, 2014 11:01:11 PM Phil Oester wrote:
> Yes, don't use -I to insert the limit rules at the very top of the INPUT
> chain. But if you insist upon doing so, exempt your LAN from the rules
> by adding "-s ! 199.x.x.x/22" to the two recent rules.
Or "! -s 199.x.x.x/22" since 'infix' notation has been removed from recent
versions of iptables.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: rate limits
2014-01-19 20:49 ` Neal Murphy
@ 2014-01-22 2:00 ` Nick Edwards
0 siblings, 0 replies; 4+ messages in thread
From: Nick Edwards @ 2014-01-22 2:00 UTC (permalink / raw)
To: neal.p.murphy; +Cc: netfilter
Thanks, opted for -A seems to work now, no idea why it didn't originally
On 1/20/14, Neal Murphy <neal.p.murphy@alum.wpi.edu> wrote:
> On Saturday, January 18, 2014 11:01:11 PM Phil Oester wrote:
>> Yes, don't use -I to insert the limit rules at the very top of the INPUT
>> chain. But if you insist upon doing so, exempt your LAN from the rules
>> by adding "-s ! 199.x.x.x/22" to the two recent rules.
>
> Or "! -s 199.x.x.x/22" since 'infix' notation has been removed from recent
> versions of iptables.
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2014-01-22 2:00 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-01-19 2:43 rate limits Nick Edwards
2014-01-19 4:01 ` Phil Oester
2014-01-19 20:49 ` Neal Murphy
2014-01-22 2:00 ` Nick Edwards
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.