libxt_connlimit.man revision c6775d6c192f7e337360f238cc3ab224a406d5b8
1Allows you to restrict the number of parallel connections to a server per 2client IP address (or client address block). 3.TP 4[\fB!\fP] \fB\-\-connlimit\-above\fP \fIn\fP 5Match if the number of existing connections is (not) above \fIn\fP. 6.TP 7\fB\-\-connlimit\-mask\fP \fIprefix_length\fP 8Group hosts using the prefix length. For IPv4, this must be a number between 9(including) 0 and 32. For IPv6, between 0 and 128. 10.P 11Examples: 12.TP 13# allow 2 telnet connections per client host 14iptables \-A INPUT \-p tcp \-\-syn \-\-dport 23 \-m connlimit \-\-connlimit\-above 2 \-j REJECT 15.TP 16# you can also match the other way around: 17iptables \-A INPUT \-p tcp \-\-syn \-\-dport 23 \-m connlimit ! \-\-connlimit\-above 2 \-j ACCEPT 18.TP 19# limit the number of parallel HTTP requests to 16 per class C sized \ 20network (24 bit netmask) 21iptables \-p tcp \-\-syn \-\-dport 80 \-m connlimit \-\-connlimit\-above 16 22\-\-connlimit\-mask 24 \-j REJECT 23.TP 24# limit the number of parallel HTTP requests to 16 for the link local network 25(ipv6) 26ip6tables \-p tcp \-\-syn \-\-dport 80 \-s fe80::/64 \-m connlimit \-\-connlimit\-above 2716 \-\-connlimit\-mask 64 \-j REJECT 28