0

I am currently using the following to limit IP connections:

iptables -A INPUT -p tcp --syn --dport 22 -m connlimit --connlimit-above 4 --connlimit-mask 32 -j REJECT --reject-with tcp-reset

To limit connection per IP to port 22, so the connection limit is 4, but some times I see some IPs still can connect with 50 connection. Any advice to fix this? My tables are as follow:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
REJECT     tcp  --  anywhere             anywhere             tcp dpt:20000 flags:FIN,SYN,RST,ACK/SYN #conn src/32 > 2 reject-with tcp-reset
REJECT     tcp  --  anywhere             anywhere             tcp dpt:ssh flags:FIN,SYN,RST,ACK/SYN #conn src/32 > 2 reject-with tcp-reset

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination


netstat -ant | awk '{print $6}' | sort | uniq -c | sort -n
      1 CLOSE_WAIT
      1 established)
      1 Foreign
      6 FIN_WAIT2
     11 LISTEN
     12 TIME_WAIT
     58 FIN_WAIT1
     80 ESTABLISHED
     90 LAST_ACK
    135 SYN_RECV

added iptables

sudo iptables -v -x -n -L
Chain INPUT (policy ACCEPT 12000346 packets, 771042886 bytes)
    pkts      bytes target     prot opt in     out     source               destination  
       0        0 ACCEPT     tcp  --  lxcbr0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
       0        0 ACCEPT     udp  --  lxcbr0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
       0        0 ACCEPT     tcp  --  lxcbr0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:67
       0        0 ACCEPT     udp  --  lxcbr0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
       0        0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:20000 flags:0x17/0x02 #conn src/32 > 2 reject-with tcp-reset
  401401 20329584 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22 flags:0x17/0x02 #conn src/32 > 2 reject-with tcp-reset

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination  
       0        0 ACCEPT     all  --  *      lxcbr0  0.0.0.0/0            0.0.0.0/0      
       0        0 ACCEPT     all  --  lxcbr0 *       0.0.0.0/0            0.0.0.0/0      

Chain OUTPUT (policy ACCEPT 11508472 packets, 493814350 bytes)
    pkts      bytes target     prot opt in     out     source               destination  
12
  • Your rule seems to be fine. Could you show us the overall context of your entire iptables rule set? Can you show us how you determined that an ip had 50 connections at the same time to port 22. Aug 27 '16 at 14:53
  • @DougSmythies i added my iptables and how it looks i still cannot limit the connection per ip some ips while attack are going to 500 connections , also i tried your solution still the same result Aug 30 '16 at 5:08
  • I am having difficulty understanding what is going on. Please add the counters to your iptables stuff above, so we can observe how many times the REJECT path was taken. I'm asking you to replace your iptables list with the output of sudo iptables -v -x -n -L. In your summarized list are those 135 SYN_RECV connections all to port 20000 or 22? And all from the same or a small number of IPs? Aug 30 '16 at 15:00
  • they are all on port 22, there is about 100 ips they are all have connection between 4 , and 1 and at the end of the list there is about 5 ips have high number of connection like 150 and more Aug 30 '16 at 15:35
  • @DougSmythies also added the new iptables that you requested Aug 30 '16 at 16:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.