From: /dev/rob0 <rob0@gmx.co.uk>
To: netfilter@vger.kernel.org
Subject: Re: noob question howto using iptables limit ip access times
Date: Mon, 21 Jun 2010 06:53:03 -0500 [thread overview]
Message-ID: <20100621115303.GO19868@cardinal> (raw)
In-Reply-To: <AANLkTimidapf_oJzL3tN2U275oX-nubojD5YRC6mwS-H@mail.gmail.com>
On Mon, Jun 21, 2010 at 07:30:32PM +0800, Zhu Jing wrote:
> My aim is limit ip access to my squid server with 1000 times per day.
> If this ip connections counts more then 1000,iptables will drop it.
snip
> iptables -A squid -m limit --limit 1/hour --limit-burst 1000 -j RETURN
>
> IMO: this rule means ,the limit-burst token bucket is set to 1000
> initially, for each hour token count goes up by 1, when token bucket
> is empty---> not match --> go next rule
No, the burst is the number of packets arriving at once. I think you
want:
iptables -A squid -m limit --limit 1000/day -j RETURN
optionally with a reasonable burst limit: --limit-burst 100
See also the more featureful connlimit and hashlimit matches. Perhaps
-m recent might meet your need, too.
--
Offlist mail to this address is discarded unless
"/dev/rob0" or "not-spam" is in Subject: header
next prev parent reply other threads:[~2010-06-21 11:53 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-06-21 11:30 noob question howto using iptables limit ip access times Zhu Jing
2010-06-21 11:53 ` /dev/rob0 [this message]
2010-06-21 12:02 ` Pascal Hambourg
2010-06-21 14:58 ` Curby
2010-06-22 4:38 ` Zhu Jing
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20100621115303.GO19868@cardinal \
--to=rob0@gmx.co.uk \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox