Limit

Limit

[Lyubomir Louisov]

So how can i limit the number of connections on port 3333 to no more than 10
at a time with iptable?
Is it posible?

Re: Limit

[Taylor, Grant]

Take a look at the connlimit match extension.

iptables -t filter -A INPUT -i ${WAN} -d ${WANIPAddress} -p tcp --dport 3333 -m connlimit --connlimit-above 10 -j DROP



Grant. . . .

Lyubomir Louisov wrote:
> So how can i limit the number of connections on port 3333 to no more than 10
> at a time with iptable?
> Is it posible?

Re: Limit

[Damon Gray]

I agree connlimit is currently the way to go, however I would make two
modifications to the example below.

iptables -t filter -A INPUT -i ${WAN} -d ${WANIPAddress}
    -p tcp --syn --dport 3333 -m connlimit --connlimit-above 10
    -j REJECT --reject-with tcp-reset

Notice the --syn and -j REJECT. I prefer rejects because if you just drop
the SYN packets most TCP stacks (by RFC) send up to 4 or 5 more to make
sure they got through. You could also send an icmp port unreachable or 
something as well.

-Damon-

On Fri, 26 Aug 2005, Taylor, Grant wrote:

> Take a look at the connlimit match extension.
>
> iptables -t filter -A INPUT -i ${WAN} -d ${WANIPAddress} -p tcp --dport 3333 -m connlimit --connlimit-above 10 -j DROP
>
>
>
> Grant. . . .
>
> Lyubomir Louisov wrote:
>> So how can i limit the number of connections on port 3333 to no more than 10
>> at a time with iptable?
>> Is it posible?
>
>
>
>

Re: Limit

[Damon Gray]

There is a way with connlimit to limit from all IPs, add a 
--connlimit-mask 0


On Fri, 26 Aug 2005, Daniel Lopes wrote:

> Taylor, Grant schrieb:
>> Take a look at the connlimit match extension.
>> 
>> iptables -t filter -A INPUT -i ${WAN} -d ${WANIPAddress} -p tcp --dport 
>> 3333 -m connlimit --connlimit-above 10 -j DROP
>> 
>> 
>> 
>> Grant. . . .
>> 
>> Lyubomir Louisov wrote:
>> 
>>> So how can i limit the number of connections on port 3333 to no more than 
>>> 10
>>> at a time with iptable?
>>> Is it posible?
>> 
>> 
>> 
>> 
> I first thought about the same thing. But that will allow more than 10 
> connections in total. It will allow only 10 connections per IP but afaik in 
> total it can then be alot more than 10 depending on the IPs connecting. Don't 
> know how you can limit it to 10 connections in total but there must be a way 
> with so much options being available for iptables ;). Please correct me if I 
> am wrong.
>
>
>

Re: Limit

[Daniel Lopes]

Taylor, Grant schrieb:
> Take a look at the connlimit match extension.
> 
> iptables -t filter -A INPUT -i ${WAN} -d ${WANIPAddress} -p tcp --dport 3333 -m connlimit --connlimit-above 10 -j DROP
> 
> 
> 
> Grant. . . .
> 
> Lyubomir Louisov wrote:
> 
>>So how can i limit the number of connections on port 3333 to no more than 10
>>at a time with iptable?
>>Is it posible?
> 
> 
> 
> 
I first thought about the same thing. But that will allow more than 10 
connections in total. It will allow only 10 connections per IP but afaik 
in total it can then be alot more than 10 depending on the IPs 
connecting. Don't know how you can limit it to 10 connections in total 
but there must be a way with so much options being available for 
iptables ;). Please correct me if I am wrong.

Re: Limit

[Taylor, Grant]

*nod*  You are quite correct sir.

iptables -t filter -A INPUT -i ${WAN} -d ${WANIPAddress} -p tcp --dport 3333 -m connlimit --connlimit-mask 0 --connlimit-above 10 -j DROP



Grant. . . .

Damon Gray wrote:
> 
> There is a way with connlimit to limit from all IPs, add a
> --connlimit-mask 0