How to limit the rate of the TCP connections from a subnet?

How to limit the rate of the TCP connections from a subnet?

[lu.peng]

Hi, all,

      I want to limit the rate of the TCP connections of every single ip from a specific subnet, but i can't find a good way to do that.

      I have studied two matches:
      1, 'connlimit'  match
          but unfortunately,  'connlimit' match provide two ways to limit the sum of the TCP connections:
          1) single IP
          2) whole subnet not every single ip of the subnet
         and most importantly, it can not limit the rate , just limit the sum of the TCP connections.

      2, 'limit'  matches:
           I can use  '-p tcp --syn -m limit --limit 6/m ......' to limit the rate of the TCP connections of the whole subnet or single ip. if i want to limit the rate of every single ip of the specific subnet, I should set a rule for every ip.

      what i want is :  only one rule can achieve ---limit the rate of the TCP connections of every single ip from a specific subnet.


      sorry for my poor english,  I hope you can know what i mean. Please help me if you know how.

      Thanks in advance.
         
     
        
      

Re: How to limit the rate of the TCP connections from a subnet?

[Jvalencia]

> 
> Hi, all,
> 
>       I want to limit the rate of the TCP connections of every single ip from a specific subnet, but i can't find a good way to do that.
> 

You can always use a simple script to generate a list of iptable rules for the specified subnet. A simple bash "for" can do it.

Re: How to limit the rate of the TCP connections from a subnet?

[Samuel Jean]

lu.peng wrote:

>Hi, all,
>
>      I want to limit the rate of the TCP connections of every single ip from a specific subnet, but i can't find a good way to do that.
>  
>
So, that's netfilter@lists.netfilter.org question ?

> <>
> I have studied two matches:
> 1, 'connlimit' match
> but unfortunately, 'connlimit' match provide two ways to limit the sum
> of the TCP connections:
> 1) single IP
> 2) whole subnet not every single ip of the subnet
> and most importantly, it can not limit the rate , just limit the sum
> of the TCP connections.
>
> 2, 'limit' matches:
> I can use '-p tcp --syn -m limit --limit 6/m ......' to limit the rate
> of the TCP connections of the whole subnet or single ip. if i want to
> limit the rate of every single ip of the specific subnet, I should set
> a ule for every ip.
> what i want is : only one rule can achieve ---limit the rate of the
> TCP connections of every single ip from a specific subnet.
>
And what about 'recent' match ?