Re: max-src-conn-rate (Connection rate throttling per IP)

[Sascha Reissner <sascha.reissner@toxicnet.de>]

Benoit Panizzon wrote:
> Hi all
> 
> I'm looking for a way to prevent connection DOSing of specific services.
> 
> The goal is to count the connection rate per conneting ip and then reject 
> those connections if they pass a certain limit.
> 
> It looks like OpenBSD's pf is the only packet filter (except some commerctial 
> Firewalls) which has this ability.
> 
> The best I managed with iptables is to throttle the connection rate for a 
> specific port, but this of course affecs normal users trying to use that 
> service and does not change the fact of the service being DOSed.
> 
> The other possibility I found is to write my own userspace QUEUE target 
> connection rate tracker via the iptables api. But as I'm not a programmer and 
> I think this is a quite common request I just wonder:
> 
> Hasn't allready somebody written such a per source connection rate limmiter?
> 
> Is there a repository of different userspace QUEUE tools where I could find 
> something similar?
> 
> Regards

Uhm, why don't you just use features that are already built into 
iptables? Like the following:

iptables -I INPUT -i <interface> -p <protocol> --dport <port> -m state 
--state NEW -m recent --set
iptables -I INPUT -i <interface> -p <protocol> --dport <port> -m state 
--state NEW -m recent --update --seconds 60 --hitcount 3 -j DROP

Just exchange <interface>, <protocol> and <port> and maybe the timspan 
and hitcount. This will DROP incoming _new_ connections if they exceed 
the counter in a given timeframe. It will resume accepting _new_ 
connection requests from the given source ip address once the counter to 
timespan treshold does not get exceeded.

I use this to prevent simple scripts from bruteforcing my sshd.

Okay you might run into problems if people use forged source ip adresses 
since this would also block _new_ connection requests from this ip.

If someone has a smarter idea - let me know.

Regards,
Sascha