ip6t-firewall-server: Clamp the advertised MSS of incoming HTTPS SYN packets to 1360. ip6t-firewall-server,ipt-firewall-server: add some restrictions on HTTP connections to counteract attacks.

ip6t-firewall-server

@@ -644,6 +644,26 @@ echo_skipped
 #echo_done
 
 
+# ---
+# - IPv6 TCP MSS adjustment for incoming HTTPS connections
+# ---
+# The IPv6 path MTU can be smaller than the interface MTU.
+# Clamp the advertised MSS of incoming HTTPS SYN packets to 1360.
+# This prevents oversized TCP segments in server responses.
+#
+# Tested on oolm-shop on 2026-10-26.
+# ---
+
+echononl "\tAdjust IPv6 TCP MSS for HTTPS connections"
+
+$ip6t -t mangle -A PREROUTING -i eth0 \
+   -p tcp --dport 443 \
+   --tcp-flags SYN,RST SYN \
+   -j TCPMSS --set-mss 1360
+
+echo_done
+
+
 # ---
 # Drop TCP packets that are new and are not SYN
 # ---
@@ -2057,6 +2077,74 @@ echo_done
 # - HTTP(S) (local) Webserver
 # ---
 
+echo ""
+echononl "\t\tA maximum of 30 new connections per second per IP"
+
+if $log_rejected || $log_all ; then
+   $ip6t -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
+   -m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
+   --hashlimit-above 30/second --hashlimit-burst 60 \
+   --hashlimit-htable-expire 600000 \
+   -m limit --limit 10/second --limit-burst 20 \
+   -j $LOG_TARGET $tag_log_prefix "$log_prefix more then 30 new connections"
+fi
+
+# HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen
+# Über 30 neue Verbindungen/s pro IP werden gedroppt
+# Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000).
+$ip6t -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
+  -m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
+  --hashlimit-above 30/second --hashlimit-burst 60 \
+  --hashlimit-htable-expire 600000 -j DROP
+
+echo_done
+
+
+echononl "\t\tA maximum of 50 concurrent TCP connections per IP"
+
+if $log_rejected || $log_all ; then
+   $ip6t -A INPUT -p tcp -m multiport --dports 80,443 --syn \
+   -m connlimit --connlimit-above 50 --connlimit-mask 128 \
+   -m limit --limit 10/second --limit-burst 20 \
+   -j $LOG_TARGET $tag_log_prefix "$log_prefix more then 50 concurrent connections."
+fi
+
+# HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen
+# Mehr als 50 parallele TCP-Verbindungen pro IP ablehnen
+#
+# Limit gilt pro einzelner IPv4-Adresse (--connlimit-mask 128) (z.bsp.  2a01:599:108:40b0:e1a9:170b:ba18:fd58/128)
+$ip6t -A INPUT -p tcp -m multiport --dports 80,443 --syn \
+  -m connlimit --connlimit-above 50 --connlimit-mask 128 \
+  -j REJECT --reject-with tcp-reset
+
+echo_done
+
+
+echononl "\t\tA maximum of 200 new TCP handshakes per second."
+
+# SYN-Rate begrenzen
+#
+# Kurzfristig auch bis zu 400 syn pakete erlaubt. --limit-burst 400 - Danach greift das Limit."
+$ip6t -A INPUT -p tcp -m multiport --dports 80,443 \
+   --syn \
+   -m limit --limit 200/second --limit-burst 400 \
+   -j ACCEPT
+
+if $log_rejected || $log_all ; then
+   $ip6t -A INPUT -p tcp -m multiport --dports 80,443 \
+   --syn \
+   -m limit --limit 10/second --limit-burst 20 \
+   -j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow."
+fi
+
+$ip6t -A INPUT -p tcp -m multiport --dports 80,443 \
+   --syn \
+   -j DROP
+
+echo_done
+echo ""
+
+
 echononl "\t\tHTTP(S) (local) Webserver"
 
 if [[ ${#http_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_http_server_ip_arr[@]} -gt 0 ]]  ; then

ipt-firewall-server

@@ -2241,6 +2241,74 @@ echo_done
 # - HTTP(S) (local) Webserver
 # ---
 
+echo ""
+echononl "\t\tA maximum of 30 new connections per second per IP"
+
+if $log_rejected || $log_all ; then
+   $ipt -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
+   -m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
+   --hashlimit-above 30/second --hashlimit-burst 60 \
+   --hashlimit-htable-expire 600000 \
+   -m limit --limit 10/second --limit-burst 20 \
+   -j $LOG_TARGET $tag_log_prefix "$log_prefix more then 30 new connections"
+fi
+
+# HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen
+# Über 30 neue Verbindungen/s pro IP werden gedroppt
+# Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000).
+$ipt -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
+  -m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
+  --hashlimit-above 30/second --hashlimit-burst 60 \
+  --hashlimit-htable-expire 600000 -j DROP
+
+echo_done
+
+
+echononl "\t\tA maximum of 50 concurrent TCP connections per IP"
+
+if $log_rejected || $log_all ; then
+   $ipt -A INPUT -p tcp -m multiport --dports 80,443 --syn \
+   -m connlimit --connlimit-above 50 --connlimit-mask 128 \
+   -m limit --limit 10/second --limit-burst 20 \
+   -j $LOG_TARGET $tag_log_prefix "$log_prefix more then 50 concurrent connections."
+fi
+
+# HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen
+# Mehr als 50 parallele TCP-Verbindungen pro IP ablehnen
+#
+# Limit gilt pro einzelner IPv4-Adresse (--connlimit-mask 128) (z.bsp.  2a01:599:108:40b0:e1a9:170b:ba18:fd58/128)
+$ipt -A INPUT -p tcp -m multiport --dports 80,443 --syn \
+  -m connlimit --connlimit-above 50 --connlimit-mask 128 \
+  -j REJECT --reject-with tcp-reset
+
+echo_done
+
+
+echononl "\t\tA maximum of 200 new TCP handshakes per second."
+
+# SYN-Rate begrenzen
+#
+# Kurzfristig auch bis zu 400 syn pakete erlaubt. --limit-burst 400 - Danach greift das Limit."
+$ipt -A INPUT -p tcp -m multiport --dports 80,443 \
+   --syn \
+   -m limit --limit 200/second --limit-burst 400 \
+   -j ACCEPT
+
+if $log_rejected || $log_all ; then
+   $ipt -A INPUT -p tcp -m multiport --dports 80,443 \
+   --syn \
+   -m limit --limit 10/second --limit-burst 20 \
+   -j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow."
+fi
+
+$ipt -A INPUT -p tcp -m multiport --dports 80,443 \
+   --syn \
+   -j DROP
+
+echo_done
+echo ""
+
+
 echononl "\t\tHTTP(S) (local) Webserver"
 
 if [[ ${#http_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_http_server_ip_arr[@]} -gt 0 ]]  ; then