From: Nick Drage <nickd@metastasis.org.uk>
To: netfilter@lists.netfilter.org
Subject: Re: stop accepting new connections on port 80
Date: Wed, 14 Dec 2005 20:33:40 +0000 [thread overview]
Message-ID: <20051214203339.GE21572@metastasis.org.uk> (raw)
In-Reply-To: <20051207123420.V66917@uberwoo.hedgpeth.com>
On Wed, Dec 07, 2005 at 12:38:51 -0800, Spam User wrote:
> I've been trying to figure out how to get iptables to stop accepting
> new connections on port 80 while letting the existing connections
> finish up what they're doing.
>
> I thought it would be as easy as removing the rule that allows new
> connections and leaving the rule that allowed related and established
> connections, but when I remove the rule that allows new connections,
> all connections stop working.
When you say "all connections", what do you mean?
Do you mean TCP connections, or browsing sessions? I've never really
looked at it in detail but I'm wondering if you're expecting HTTP
sessions to stay up while someone views a site, whereas *IIRC* while a
user web-browses numerous separate HTTP connections are opened and
closed in quick succession. Therefore as soon as you stop accepting new
TCP connections all web browsing will stop, even for people with a
half-loaded page.
Why do you want to stop new sessions? If we take a step back [1] maybe
there's a different solution to your overall problem.
[1] "take a step back"... sorry, next thing you know we'll be running
ideas up the flagpole.
--
morals are for little people
Jenny Solzer
next prev parent reply other threads:[~2005-12-14 20:33 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-12-07 20:38 stop accepting new connections on port 80 Spam User
2005-12-09 18:42 ` Bill Hance
2005-12-09 19:08 ` R. DuFresne
2006-01-03 7:12 ` Jan Engelhardt
2005-12-14 20:33 ` Nick Drage [this message]
-- strict thread matches above, loose matches on Subject: below --
2005-12-07 21:58 Derick Anderson
2005-12-07 22:18 ` Spam User
2005-12-08 13:50 Derick Anderson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20051214203339.GE21572@metastasis.org.uk \
--to=nickd@metastasis.org.uk \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox