Limiting number of connections

[Charlie Reitsma <reitsmac@denison.edu>]

the iplimit patch applies easiest to protocol tcp...it leaves out udp. 
On my firewall the clients who are creating 200+ connections are using 
udp. I've seen examples of iplimit for udp but attempts to use
iptables -A INPUT -p udp -m iplimit --iplimit-above 80 -j DROP
results in "invalid argument." Being able to look at the connection 
table and limiting each source address to some number of entries is more 
like what one would expect of a module that limits the number of 
connections any client may create. I agree with Daniel that a script 
that adds/remove drop rules would work. Perhaps the script could make 
use of the "recent" module as discussed at 
http://www.stearns.org/doc/adaptive-firewalls.v0.1.html

Charlie
--------------
Alex wrote:
I presume this is exactly what you are asking?

From... patch-o-matic/base/iplimit.patch.help

Author: Gerd Knorr <kraxel@bytesex.org>
Status: ItWorksForMe[tm]

This adds CONFIG_IP_NF_MATCH_IPLIMIT match allows you to restrict the
number of parallel TCP connections to a server per client IP address
(or address block).

Examples:

# allow 2 telnet connections per client host
iptables -p tcp --syn --dport 23 -m iplimit --iplimit-above 2 -j REJECT

# you can also match the other way around:
iptables -p tcp --syn --dport 23 -m iplimit ! --iplimit-above 2 -j
ACCEPT

# limit the nr of parallel http requests to 16 per class C sized
# network (24 bit netmask)
iptables -p tcp --syn --dport 80 -m iplimit --iplimit-above 16		\
	--iplimit-mask 24 -j REJECT

Good luck - Alex.

On Fri, 2003-01-03 at 16:47, Daniel Fenert wrote:
 > Is there a simple way to limit number of connection coming from 
particular
 > client (ip address or subnet)?
 > I've searched through archive, and found only some patch to CVS version
 > of netfilter (it was year 2000)...
 >
 > I've got problem with a few clients, they' are able to make 200+
 > connections on 128Kbit connection (according to /proc/net/ip_conntrack)
 >
 > I thought about it today for a few minutes, and came with the idea:
 > 1) Parse /proc/net/ip_conntrack and get clients with more than xxx
 >    connections
 > 2) Setup rule to DROP NEW,RELATED to force them to close some connections
 > 3) wait a minute, go to 1) checking additionally number of connections
 >    for blocked IP's. If number drops below xxx, delete rule DROP NEW,...
 > This is ugly, but possibly will work.
 >
 > I hope that  there's better way to do it?