From: Federico Petronio <petronio@agro.uba.ar>
To: netfilter@lists.netfilter.org
Subject: conn limit question (limit module or similar)
Date: Thu, 13 Nov 2003 12:11:18 -0300 [thread overview]
Message-ID: <3FB39F16.2010708@agro.uba.ar> (raw)
Hello all...
I use for some time a module called 'limit' to limit the amount of
connections per timeunit to my SMTP server. But the limitations I found
is that you need to write a rule that matches to apply the filter:
-A INPUT -s 0/0 -d 0/0 -m limit --limit 60/minute --limit-burst 45 -m
tcp -p tcp --dport 25 --syn -j SMTPCHAINS
I mean... it is not possible to define something like:
"do no accept more than 60 connections per minute for ANY IP, and, if
that limit is reach for some IP, do not limit the rest of connections"
since you can not write a rule for all the possible IPs. I found a (not
so good) solution to this... I divided the IPs range in 8 groups:
-A SMTPCHAINS -s 0.0.0.0/0.0.0.7 -d 0/0 -m limit --limit 45/minute
--limit-burst 20 -m tcp -p tcp --dport 25 --syn -j ACCEPT
-A SMTPCHAINS -s 0.0.0.1/0.0.0.7 -d 0/0 -m limit --limit 45/minute
--limit-burst 20 -m tcp -p tcp --dport 25 --syn -j ACCEPT
-A SMTPCHAINS -s 0.0.0.2/0.0.0.7 -d 0/0 -m limit --limit 45/minute
--limit-burst 20 -m tcp -p tcp --dport 25 --syn -j ACCEPT
-A SMTPCHAINS -s 0.0.0.3/0.0.0.7 -d 0/0 -m limit --limit 45/minute
--limit-burst 20 -m tcp -p tcp --dport 25 --syn -j ACCEPT
-A SMTPCHAINS -s 0.0.0.4/0.0.0.7 -d 0/0 -m limit --limit 45/minute
--limit-burst 20 -m tcp -p tcp --dport 25 --syn -j ACCEPT
-A SMTPCHAINS -s 0.0.0.5/0.0.0.7 -d 0/0 -m limit --limit 45/minute
--limit-burst 20 -m tcp -p tcp --dport 25 --syn -j ACCEPT
-A SMTPCHAINS -s 0.0.0.6/0.0.0.7 -d 0/0 -m limit --limit 45/minute
--limit-burst 20 -m tcp -p tcp --dport 25 --syn -j ACCEPT
-A SMTPCHAINS -s 0.0.0.7/0.0.0.7 -d 0/0 -m limit --limit 45/minute
--limit-burst 20 -m tcp -p tcp --dport 25 --syn -j ACCEPT
but I stell want something better. I guess that using some kind of
connection trucking to know the histoty of connections from each IP
could be the solution.
The question is... Is there any module o reluset that achive that?
Thank you very much....
--
Federico Petronio
petronio@agro.uba.ar
Linux User #129974
---
There are only 10 types of people in the world:
Those who understand binary and those who don't.
reply other threads:[~2003-11-13 15:11 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3FB39F16.2010708@agro.uba.ar \
--to=petronio@agro.uba.ar \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.