I'm using these rules in /etc/ufw/before.rules
# Limit to 20 concurrent connections on port 80 per IP
-A ufw-before-input -p tcp --syn --dport 80 -m connlimit --connlimit-above 20 -j DROP
-A ufw-before-input -p tcp --syn --dport 443 -m connlimit --connlimit-above 20 -j DROP
# Limit to 20 connections on port 80 per 2 seconds per IP
-A ufw-before-input -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set
-A ufw-before-input -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --update --seconds 2 --hitcount 20 -j DROP
-A ufw-before-input -p tcp --dport 443 -i eth0 -m state --state NEW -m recent --set
-A ufw-before-input -p tcp --dport 443 -i eth0 -m state --state NEW -m recent --update --seconds 2 --hitcount 20 -j DROP
I want to add a rule that will force the local system ips to not be connection or rate limited at all. For example, I have many cron jobs that connect to the server within the server. I need to prevent these from failing when too many are running at once.
UPDATE WITH SOLUTION: I think I just had to add more rules in before.rules instead of ufw command line to override the connection limit for specific ips. I can't answer my own question yet.
I just adds these rules above the connlimit rules:
-A ufw-before-input -p tcp --dport 80 -s 127.0.0.1 -j ACCEPT
-A ufw-before-input -p tcp --dport 443 -s 127.0.0.1 -j ACCEPT