Re: -m limit

[Anders Fugmann <afu@fugmann.dhs.org>]

Luís Fernando C. Talora wrote:
> Fellows,
> 
> I'd like some help using ntefilter "limit" module.
> 
> If I put something like the following in a firewall script (to limit tcp syn
> packets):
> 
> # Block tcp syn floods
>      $IPTABLES -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
> 
>         (and then, latter, I put the following)
> 
> # Access to my web server
>      $IPTABLES -A FORWARD -p tcp -d $MY_WEB_SERVER --dport 80 -j ACCEPT

This is definatly dot what you want. As it is now, 1 syn packet is 
acceted per sec, regardless of destination port or address.

> 
> In this example, will a tcp syn flood be barred by the first line? Is it the
> second line allowing more than 1 packet per second? Do I have to use "-m
> limit --limit 1/s" on the second line too (and all lines that allow incoming
> packets)?
No. If you want to limit all syn packets you mist create a new chain. 
like this:

$IPTABLES -N LIMIT_SYN
$IPTABLES -A LIMIT_SYN -m limit --limit 1/s -j RETURN
$IPTABLES -A LIMIT_SYN -j DROP
$IPTABLES -A FORWARD -p tcp --syn -j LIMIT_SYN

This contrsruction limit syn to one per sec by dropping syns above the 
limit (Acts like a filter). You then need other rules to actually accept 
the syn packet:

$IPTABLES -A FORWARD -p tcp -d $MY_WEB_SERVER --dport 80 -j ACCEPT

If you only want to limit http requests, you should  use
$IPTABLES -A FORWARD -p tcp -d $MY_WEB_SERVER --dport 80 --syn \
	-m limit --limit 1/s -j ACCEPT

Hope it helps.

-- 
Author of FIAIF
FIAIF Is An Intelligent Firewall
http://fiaif.fugmann.dhs.org