libxt_connlimit.man revision 5da9e63f66ca190cb90193ebb9eebf5aa523b4d1 
1Allows you to restrict the number of parallel connections to a server per
2client IP address (or client address block).
3.TP
4\fB\-\-connlimit\-upto\fP \fIn\fP
5Match if the number of existing connections is below or equal \fIn\fP.
6.TP
7\fB\-\-connlimit\-above\fP \fIn\fP
8Match if the number of existing connections is above \fIn\fP.
9.TP
10\fB\-\-connlimit\-mask\fP \fIprefix_length\fP
11Group hosts using the prefix length. For IPv4, this must be a number between
12(including) 0 and 32. For IPv6, between 0 and 128. If not specified, the
13maximum prefix length for the applicable protocol is used.
14.TP
15\fB\-\-connlimit\-saddr\fP
16Apply the limit onto the source group.
17.TP
18\fB\-\-connlimit\-daddr\fP
19Apply the limit onto the destination group.
20.PP
21Examples:
22.TP
23# allow 2 telnet connections per client host
24iptables \-A INPUT \-p tcp \-\-syn \-\-dport 23 \-m connlimit \-\-connlimit\-above 2 \-j REJECT
25.TP
26# you can also match the other way around:
27iptables \-A INPUT \-p tcp \-\-syn \-\-dport 23 \-m connlimit \-\-connlimit\-upto 2 \-j ACCEPT
28.TP
29# limit the number of parallel HTTP requests to 16 per class C sized \
30source network (24 bit netmask)
31iptables \-p tcp \-\-syn \-\-dport 80 \-m connlimit \-\-connlimit\-above 16
32\-\-connlimit\-mask 24 \-j REJECT
33.TP
34# limit the number of parallel HTTP requests to 16 for the link local network
35(ipv6)
36ip6tables \-p tcp \-\-syn \-\-dport 80 \-s fe80::/64 \-m connlimit \-\-connlimit\-above
3716 \-\-connlimit\-mask 64 \-j REJECT
38.TP
39# Limit the number of connections to a particular host:
40ip6tables \-p tcp \-\-syn \-\-dport 49152:65535 \-d 2001:db8::1 \-m connlimit
41\-\-connlimit-above 100 \-j REJECT
42