libxt_connlimit.man revision e37d45ce390c2f5a7f1e64742b9100ecef0def54
1b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.orgAllows you to restrict the number of parallel connections to a server per 2b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.orgclient IP address (or client address block). 3b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org.TP 4b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org\fB\-\-connlimit\-upto\fP \fIn\fP 5b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.orgMatch if the number of existing connections is below or equal \fIn\fP. 6b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org.TP 7b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org\fB\-\-connlimit\-above\fP \fIn\fP 8b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.orgMatch if the number of existing connections is above \fIn\fP. 9b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org.TP 10b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org\fB\-\-connlimit\-mask\fP \fIprefix_length\fP 11b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.orgGroup hosts using the prefix length. For IPv4, this must be a number between 12b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org(including) 0 and 32. For IPv6, between 0 and 128. If not specified, the 13b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.orgmaximum prefix length for the applicable protocol is used. 14b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org.TP 15b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org\fB\-\-connlimit\-saddr\fP 16b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.orgApply the limit onto the source group. 17b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org.TP 18b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org\fB\-\-connlimit\-daddr\fP 19b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.orgApply the limit onto the destination group. 20b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org.PP 21b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.orgExamples: 22b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org.TP 23b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org# allow 2 telnet connections per client host 24b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.orgiptables \-A INPUT \-p tcp \-\-syn \-\-dport 23 \-m connlimit \-\-connlimit\-above 2 \-j REJECT 25b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org.TP 26b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org# you can also match the other way around: 27b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.orgiptables \-A INPUT \-p tcp \-\-syn \-\-dport 23 \-m connlimit \-\-connlimit\-upto 2 \-j ACCEPT 28b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org.TP 29b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org# limit the number of parallel HTTP requests to 16 per class C sized \ 30b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.orgsource network (24 bit netmask) 31b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.orgiptables \-p tcp \-\-syn \-\-dport 80 \-m connlimit \-\-connlimit\-above 16 32b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org\-\-connlimit\-mask 24 \-j REJECT 33b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org.TP 34b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org# limit the number of parallel HTTP requests to 16 for the link local network 35b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org(ipv6) 36b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.orgip6tables \-p tcp \-\-syn \-\-dport 80 \-s fe80::/64 \-m connlimit \-\-connlimit\-above 37b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org16 \-\-connlimit\-mask 64 \-j REJECT 38b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org.TP 39b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org# Limit the number of connections to a particular host: 40b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.orgip6tables \-p tcp \-\-syn \-\-dport 49152:65535 \-d 2001:db8::1 \-m connlimit 41b015cbede88899f67a53fbbe581b02ce8e32794andrew@webrtc.org\-\-connlimit-above 100 \-j REJECT 42fbda0fcf2f9e82c82bcaac138f44d4e5144f6e0dpbos@webrtc.org