3

I'm using these rules in /etc/ufw/before.rules

# Limit to 20 concurrent connections on port 80 per IP
-A ufw-before-input -p tcp --syn --dport 80 -m connlimit --connlimit-above 20 -j DROP
-A ufw-before-input -p tcp --syn --dport 443 -m connlimit --connlimit-above 20 -j DROP

# Limit to 20 connections on port 80 per 2 seconds per IP
-A ufw-before-input -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set
-A ufw-before-input -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --update --seconds 2 --hitcount 20 -j DROP
-A ufw-before-input -p tcp --dport 443 -i eth0 -m state --state NEW -m recent --set
-A ufw-before-input -p tcp --dport 443 -i eth0 -m state --state NEW -m recent --update --seconds 2 --hitcount 20 -j DROP

I want to add a rule that will force the local system ips to not be connection or rate limited at all. For example, I have many cron jobs that connect to the server within the server. I need to prevent these from failing when too many are running at once.

UPDATE WITH SOLUTION: I think I just had to add more rules in before.rules instead of ufw command line to override the connection limit for specific ips. I can't answer my own question yet.

I just adds these rules above the connlimit rules:

-A ufw-before-input -p tcp --dport 80 -s 127.0.0.1 -j ACCEPT
-A ufw-before-input -p tcp --dport 443 -s 127.0.0.1 -j ACCEPT
0

I found another solution using iptables.

iptables command to limit connections:

iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 20 -j DROP

you can exclude one ip:

iptables -A INPUT -p tcp --syn --dport 80 -d ! 127.0.0.1 -m connlimit --connlimit-above 20 -j DROP

I hope this is helpful for you.

0

First , you have not provided sufficeint information for us to give you a specific answer.

Second, those are ufw rules. ufw is a front end for iptables and you can manage the rules from the command line, ufw or a graphical interface, gufw.

Using iptables directly will conflict with your ufw rules, so use one tool or another.

You need to post your ufw rules. In general you are going to allow your local network prior to the rules you posted. How are you managing your ufw rules? command line? gufw?

for ufw, something like this

sudo ufw allow from 192.168.0.0/24

See also:

http://blog.bodhizazen.com/linux/firewall-ubuntu-servers/

https://help.ubuntu.com/community/UFW

and for iptables http://bodhizazen.com/Tutorials/iptables

4
  • ufw already has port 80 & 443 open to all ips with ufw allow 80/tcp and ufw allow 443/tcp. If I add a rule in ufw, I don't think it will work. To do connection limiting, I had to use /etc/ufw/before.rules according to other resources. If you know a better way to do that limiting with ufw, that might help. I don't see that "ufw limit" is documented in a way that explains how to do specify how many connections at once, and over time. – Bruce Kirkpatrick Jan 16 '14 at 16:18
  • Hard to venture a guess without knowing your rules. Order of rules is critical. I do not know how a port can be allowed and limited at the same time. Also, as you can see, your connection limits on ports 80 and 443 are way too conservative, web servers can handle thousands of hits. I use sudo iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m limit --limit 50/minute --limit-burst 200 -j ACCEPT . Also REJECT is better then DROP. See unix.stackexchange.com/questions/109459/… – Panther Jan 16 '14 at 18:30
  • the limit is per ip and 20 is plenty since real users only do 2 to 6 connections per host name. I can make it a little more if have trouble with that. I'll try REJECT as you say, but i think that only helps a user avoid waiting forever for a client timeout. – Bruce Kirkpatrick Jan 16 '14 at 19:17
  • I think I just had to add more rules above those rules for the ips I want to accept. thanks. – Bruce Kirkpatrick Jan 16 '14 at 19:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.