ip6t-firewall-server: Clamp the advertised MSS of incoming HTTPS SYN packets to 1360. ip6t-firewall-server,ipt-firewall-server: add some restrictions on HTTP connections to counteract attacks.

2026-10-26 23:30:18 +01:00
parent 3418073003
commit 560ee66b07
2 changed files with 156 additions and 0 deletions
@@ -2241,6 +2241,74 @@ echo_done
 # - HTTP(S) (local) Webserver
 # ---

+echo ""
+echononl "\t\tA maximum of 30 new connections per second per IP"
+
+if $log_rejected || $log_all ; then
+   $ipt -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
+   -m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
+   --hashlimit-above 30/second --hashlimit-burst 60 \
+   --hashlimit-htable-expire 600000 \
+   -m limit --limit 10/second --limit-burst 20 \
+   -j $LOG_TARGET $tag_log_prefix "$log_prefix more then 30 new connections"
+fi
+
+# HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen
+# Über 30 neue Verbindungen/s pro IP werden gedroppt
+# Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000).
+$ipt -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
+  -m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
+  --hashlimit-above 30/second --hashlimit-burst 60 \
+  --hashlimit-htable-expire 600000 -j DROP
+
+echo_done
+
+
+echononl "\t\tA maximum of 50 concurrent TCP connections per IP"
+
+if $log_rejected || $log_all ; then
+   $ipt -A INPUT -p tcp -m multiport --dports 80,443 --syn \
+   -m connlimit --connlimit-above 50 --connlimit-mask 128 \
+   -m limit --limit 10/second --limit-burst 20 \
+   -j $LOG_TARGET $tag_log_prefix "$log_prefix more then 50 concurrent connections."
+fi
+
+# HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen
+# Mehr als 50 parallele TCP-Verbindungen pro IP ablehnen
+#
+# Limit gilt pro einzelner IPv4-Adresse (--connlimit-mask 128) (z.bsp.  2a01:599:108:40b0:e1a9:170b:ba18:fd58/128)
+$ipt -A INPUT -p tcp -m multiport --dports 80,443 --syn \
+  -m connlimit --connlimit-above 50 --connlimit-mask 128 \
+  -j REJECT --reject-with tcp-reset
+
+echo_done
+
+
+echononl "\t\tA maximum of 200 new TCP handshakes per second."
+
+# SYN-Rate begrenzen
+#
+# Kurzfristig auch bis zu 400 syn pakete erlaubt. --limit-burst 400 - Danach greift das Limit."
+$ipt -A INPUT -p tcp -m multiport --dports 80,443 \
+   --syn \
+   -m limit --limit 200/second --limit-burst 400 \
+   -j ACCEPT
+
+if $log_rejected || $log_all ; then
+   $ipt -A INPUT -p tcp -m multiport --dports 80,443 \
+   --syn \
+   -m limit --limit 10/second --limit-burst 20 \
+   -j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow."
+fi
+
+$ipt -A INPUT -p tcp -m multiport --dports 80,443 \
+   --syn \
+   -j DROP
+
+echo_done
+echo ""
+
+
 echononl "\t\tHTTP(S) (local) Webserver"

 if [[ ${#http_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_http_server_ip_arr[@]} -gt 0 ]]  ; then