Home » forums » Debian Help Forums: Users Helping Users » System Config and Admin

[HELP] iptables per host controls

Tags:

Hi,
I'm playing with iptables and I'm trying to filter SYN_floods.

I'd like to filter syn_packets with a rate limit (-m limit --limit 1/s) only if they came from the same "dynamic_IP".

For example: If ten host try to connect to my webserver in the same second and ipfilter has syn limit to 1/s nine of the connection request will be dropped by the firewall ...

I'd like ipfilter start dropping syn packet with a rate of 1/s ONLY if the source IP of the SYN packet is the SAME.

Obviously i can't make a rule for EVERY IP tryin' to synflood my webserver ??

Any ideas ?

Thanks in advance !

Zeus

Bookmark/Search this post with:
  • Delicious
  • Digg
  • StumbleUpon
  • Propeller
  • Reddit
  • Magnoliacom
  • Newsvine
  • Furl
  • Google
  • Yahoo
  • Technorati
0
‹ Direct link Debian-win98: need help to connect deleting many packages safe? ›

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

connlimit section of iptables manpage

Submitted by Matt on Thu, 2007-12-20 22:29.

Can limiting the number of simultaneous connections per IP address solve your problem, as described in the connlimit section of the iptables manpage?

»

connlimit module question

Submitted by f_zeus on Fri, 2008-01-04 15:23.

Hi, thank you for pointing me on the right way.

I still need help.
Googling about conlimit module i've discovered it's not a part of the 'standard' debian kernel distribution.
and this explain why i got this error:


# iptables -A INPUT -p tcp --syn --dport 23 -m connlimit --connlimit-above 2 -j REJECT
iptables: No chain/target/match by that name

somewhere advanced users suggest to patch the kernel via patch-o-matic

i 've never used this tool (i came form BSD+ipfw) may someone point me to a step-by-step tutorial to do this ?

Thanks in advance

»
Syndicate content