From 792d0b1b86e41c39508a3ad52185cca46d8825b2 Mon Sep 17 00:00:00 2001 From: Christoph Date: Tue, 27 Oct 2026 21:18:02 +0100 Subject: [PATCH] Configure limits for HTTPS connections. --- conf/default_settings.conf | 40 ++++++--- conf/main_ipv4.conf.sample | 24 ++++- conf/main_ipv6.conf.sample | 24 ++++- ip6t-firewall-server | 178 ++++++++++++++++++++++++++----------- 4 files changed, 200 insertions(+), 66 deletions(-) diff --git a/conf/default_settings.conf b/conf/default_settings.conf index b2fb46a..e61981d 100644 --- a/conf/default_settings.conf +++ b/conf/default_settings.conf @@ -4,7 +4,7 @@ # --- Default Parameter / Options # ------------- -default_per_IP_connection_limit=111 +default_per_IP_connection_limit=250 # ------------- @@ -56,9 +56,9 @@ standard_prometheus_ports="9100,9256" # - Mattermost (MM) Service # - -stansard_mattermost_udp_ports_in="8443" -stansard_mattermost_tcp_ports_in="8443" -stansard_mattermost_udp_ports_out="3478" +standard_mattermost_udp_ports_in="8443" +standard_mattermost_tcp_ports_in="8443" +standard_mattermost_udp_ports_out="3478" # - IPsec - Internet Security Association and # - Key Management Protocol @@ -71,6 +71,26 @@ standard_ipsec_nat_t=4500 standard_http_ports="80,443" standard_mailuser_ports="587,465,110,995,143,993" + +# ip6t-firewall-server: +# Clamp the advertised MSS of incoming HTTPS SYN packets to 1360. +# +throttle_tcp6_mss_for_https=false +default_min_tcp6_mss_for_https_val=1280 + +# ip6t-firewall-server,ipt-firewall-server: +# some restrictions on HTTP connections to counteract attacks. +# +set_max_new_http_conn_per_ip_per_second=true +default_max_http_new_conn_per_ip_per_second=30 + +set_max_concurrent_http_conn_per_ip=true +default_max_concurrent_http_conn_per_ip=50 + +set_max_new_http_conn_per_second=true +default_max_new_http_conn_per_second=200 + + # - Dovecot Service # - dovecot_external_auth_port="44444" @@ -86,20 +106,20 @@ default_jitsi_dovecout_auth_port="$dovecot_external_auth_port" default_jibri_out_port=5222 # default_outbound_streaming_tcp_ports # -# - outbound port 1935/TCP : outbound streaming over RTMP to most +# - outbound port 1935/TCP : outbound streaming over RTMP to most # streaming providers such as YouTube Live, Vimeo or Twitch # -# - outbound port 1936/TCP : outbound streaming over RTMP to LinkedIn +# - outbound port 1936/TCP : outbound streaming over RTMP to LinkedIn # Live (port 1935 is also used for RTMP streaming to LinkedIn) # -# - outbound ports 2935/TCP and 2396/TCP : outbound streaming over +# - outbound ports 2935/TCP and 2396/TCP : outbound streaming over # RTMPS to LinkedIn Live # -# - outbound port 443/TCP (HTTPS) : used for authentication with the -# built-in providers such as YouTube Live, Facebook Live, Ustream, +# - outbound port 443/TCP (HTTPS) : used for authentication with the +# built-in providers such as YouTube Live, Facebook Live, Ustream, # Livestream, and Twitch # -# - outbound port 53/UDP (DNS) used for DNS lookups converting +# - outbound port 53/UDP (DNS) used for DNS lookups converting # hostnames to IP addresses # default_outbound_streaming_tcp_ports="1935,1936,2935,2396" diff --git a/conf/main_ipv4.conf.sample b/conf/main_ipv4.conf.sample index 9b21ae7..00a76e4 100644 --- a/conf/main_ipv4.conf.sample +++ b/conf/main_ipv4.conf.sample @@ -385,6 +385,24 @@ forward_http_server_ips="" # - http_ports="$standard_http_ports" +# ip6t-firewall-server: +# Clamp the advertised MSS of incoming HTTPS SYN packets to 1360. +# +throttle_tcp6_mss_for_https=false +tcp6_mss_for_https_val=${default_min_tcp6_mss_for_https_val} + +# ip6t-firewall-server,ipt-firewall-server: +# some restrictions on HTTP connections to counteract attacks. +# +set_max_new_http_conn_per_ip_per_second=true +max_http_new_conn_per_ip_per_second=${default_max_http_new_conn_per_ip_per_second} + +set_max_concurrent_http_conn_per_ip=true +max_concurrent_http_conn_per_ip=${default_max_concurrent_http_conn_per_ip} + +set_max_new_http_conn_per_second=true +max_new_http_conn_per_second=${default_max_new_http_conn_per_second} + # - LOG CGI script Traffic out # - @@ -406,9 +424,9 @@ forward_mm_server_ips="" # - UDP Ports IN and OUT used by MM Servive # - -mm_udp_ports_in="$stansard_mattermost_udp_ports_in" -mm_tcp_ports_in="$stansard_mattermost_tcp_ports_in" -mm_udp_ports_out="$stansard_mattermost_udp_ports_out" +mm_udp_ports_in="$standard_mattermost_udp_ports_in" +mm_tcp_ports_in="$standard_mattermost_tcp_ports_in" +mm_udp_ports_out="$standard_mattermost_udp_ports_out" # - Mail SMTP Server diff --git a/conf/main_ipv6.conf.sample b/conf/main_ipv6.conf.sample index c8c6173..db49843 100644 --- a/conf/main_ipv6.conf.sample +++ b/conf/main_ipv6.conf.sample @@ -401,6 +401,24 @@ forward_http_server_ips="" # - http_ports="$standard_http_ports" +# ip6t-firewall-server: +# Clamp the advertised MSS of incoming HTTPS SYN packets to 1360. +# +throttle_tcp6_mss_for_https=false +tcp6_mss_for_https_val=${default_min_tcp6_mss_for_https_val} + +# ip6t-firewall-server,ipt-firewall-server: +# some restrictions on HTTP connections to counteract attacks. +# +set_max_new_http_conn_per_ip_per_second=true +max_http_new_conn_per_ip_per_second=${default_max_http_new_conn_per_ip_per_second} + +set_max_concurrent_http_conn_per_ip=true +max_concurrent_http_conn_per_ip=${default_max_concurrent_http_conn_per_ip} + +set_max_new_http_conn_per_second=true +max_new_http_conn_per_second=${default_max_new_http_conn_per_second} + # - LOG CGI script Traffic out # - @@ -422,9 +440,9 @@ forward_mm_server_ips="" # - UDP Ports IN and OUT used by MM Servive # - -mm_udp_ports_in="$stansard_mattermost_udp_ports_in" -mm_tcp_ports_in="$stansard_mattermost_tcp_ports_in" -mm_udp_ports_out="$stansard_mattermost_udp_ports_out" +mm_udp_ports_in="$standard_mattermost_udp_ports_in" +mm_tcp_ports_in="$standard_mattermost_tcp_ports_in" +mm_udp_ports_out="$standard_mattermost_udp_ports_out" # - Mail SMTP Server diff --git a/ip6t-firewall-server b/ip6t-firewall-server index 70902cb..b5b425e 100755 --- a/ip6t-firewall-server +++ b/ip6t-firewall-server @@ -656,12 +656,43 @@ echo_skipped echononl "\tAdjust IPv6 TCP MSS for HTTPS connections" -$ip6t -t mangle -A PREROUTING -i eth0 \ - -p tcp --dport 443 \ - --tcp-flags SYN,RST SYN \ - -j TCPMSS --set-mss 1360 +if $throttle_tcp6_mss_for_https ; then -echo_done + if [[ -n "$tcp6_mss_for_https_val" ]] ; then + + # Notice: + # + # - take care 'tcp6_mss_for_https_val' consists only of digits (is a natural number) + # + # - 1280 is the minimum IPv6 packet size that all routers must be able to process + # + if [[ "$tcp6_mss_for_https_val" =~ ^[0-9]+$ ]] ; then + + if [[ "$tcp6_mss_for_https_val" -lt 1280 ]]; then + + tcp6_mss_for_https_val=$min_tcp6_mss_for_https_val + + fi + + fi + + else + + tcp6_mss_for_https_val=$min_tcp6_mss_for_https_val + fi + + $ip6t -t mangle -A PREROUTING -i eth0 \ + -p tcp --dport 443 \ + --tcp-flags SYN,RST SYN \ + -j TCPMSS --set-mss $tcp6_mss_for_https_val + + echo_done + +else + + echo_skipped + +fi # --- @@ -2078,70 +2109,117 @@ echo_done # --- echo "" -echononl "\t\tA maximum of 30 new connections per second per IP" +echononl "\t\tA maximum number new connections per second per IP" -if $log_rejected || $log_all ; then +if $set_max_new_http_conn_per_ip_per_second ; then + + if [[ -z "$max_http_new_conn_per_ip_per_second" || ! "$max_http_new_conn_per_ip_per_second" =~ ^[0-9]+$ ]]; then + + max_http_new_conn_per_ip_per_second=$default_max_http_new_conn_per_ip_per_second + + fi + + if $log_rejected || $log_all ; then + $ip6t -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \ + -m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \ + --hashlimit-above ${max_http_new_conn_per_ip_per_second}/second --hashlimit-burst 60 \ + --hashlimit-htable-expire 600000 \ + -m limit --limit 10/second --limit-burst 20 \ + -j $LOG_TARGET $tag_log_prefix "$log_prefix more then 30 new connections" + fi + + # HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen + # Über 30 neue Verbindungen/s pro IP werden gedroppt + # Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000). $ip6t -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \ -m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \ - --hashlimit-above 30/second --hashlimit-burst 60 \ - --hashlimit-htable-expire 600000 \ - -m limit --limit 10/second --limit-burst 20 \ - -j $LOG_TARGET $tag_log_prefix "$log_prefix more then 30 new connections" + --hashlimit-above ${max_http_new_conn_per_ip_per_second}/second --hashlimit-burst 60 \ + --hashlimit-htable-expire 600000 -j DROP + + echo_done + +else + + echo_skipped + fi -# HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen -# Über 30 neue Verbindungen/s pro IP werden gedroppt -# Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000). -$ip6t -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \ - -m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \ - --hashlimit-above 30/second --hashlimit-burst 60 \ - --hashlimit-htable-expire 600000 -j DROP -echo_done +echononl "\t\tA maximum number of concurrent TCP connections per IP" -echononl "\t\tA maximum of 50 concurrent TCP connections per IP" +if $set_max_concurrent_http_conn_per_ip ; then -if $log_rejected || $log_all ; then + if [[ -z "$max_concurrent_http_conn_per_ip" || ! "$max_concurrent_http_conn_per_ip" =~ ^[0-9]+$ ]]; then + + max_concurrent_http_conn_per_ip=$default_max_concurrent_http_conn_per_ip + + fi + + if $log_rejected || $log_all ; then + $ip6t -A INPUT -p tcp -m multiport --dports 80,443 --syn \ + -m connlimit --connlimit-above $max_concurrent_http_conn_per_ip --connlimit-mask 128 \ + -m limit --limit 10/second --limit-burst 20 \ + -j $LOG_TARGET $tag_log_prefix "$log_prefix more then 50 concurrent connections." + fi + + # HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen + # Mehr als 50 parallele TCP-Verbindungen pro IP ablehnen + # + # Limit gilt pro einzelner IPv4-Adresse (--connlimit-mask 128) (z.bsp. 2a01:599:108:40b0:e1a9:170b:ba18:fd58/128) $ip6t -A INPUT -p tcp -m multiport --dports 80,443 --syn \ - -m connlimit --connlimit-above 50 --connlimit-mask 128 \ - -m limit --limit 10/second --limit-burst 20 \ - -j $LOG_TARGET $tag_log_prefix "$log_prefix more then 50 concurrent connections." + -m connlimit --connlimit-above $max_concurrent_http_conn_per_ip --connlimit-mask 128 \ + -j REJECT --reject-with tcp-reset + + echo_done + +else + + echo_skipped + fi -# HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen -# Mehr als 50 parallele TCP-Verbindungen pro IP ablehnen -# -# Limit gilt pro einzelner IPv4-Adresse (--connlimit-mask 128) (z.bsp. 2a01:599:108:40b0:e1a9:170b:ba18:fd58/128) -$ip6t -A INPUT -p tcp -m multiport --dports 80,443 --syn \ - -m connlimit --connlimit-above 50 --connlimit-mask 128 \ - -j REJECT --reject-with tcp-reset - -echo_done -echononl "\t\tA maximum of 200 new TCP handshakes per second." +echononl "\t\tA maximum number of new TCP handshakes per second." -# SYN-Rate begrenzen -# -# Kurzfristig auch bis zu 400 syn pakete erlaubt. --limit-burst 400 - Danach greift das Limit." -$ip6t -A INPUT -p tcp -m multiport --dports 80,443 \ - --syn \ - -m limit --limit 200/second --limit-burst 400 \ - -j ACCEPT +if $set_max_new_http_conn_per_second ; then -if $log_rejected || $log_all ; then + if [[ -z "$max_new_http_conn_per_second" || ! "$max_new_http_conn_per_second" =~ ^[0-9]+$ ]]; then + + max_new_http_conn_per_second=$default_max_new_http_conn_per_second + + fi + + burst_max_new_http_conn_per_second=$((2 * max_new_http_conn_per_second)) + + # SYN-Rate begrenzen + # + # Kurzfristig auch bis zu 400 syn pakete erlaubt. --limit-burst 400 - Danach greift das Limit." $ip6t -A INPUT -p tcp -m multiport --dports 80,443 \ - --syn \ - -m limit --limit 10/second --limit-burst 20 \ - -j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow." + --syn \ + -m limit --limit ${max_new_http_conn_per_second}/second --limit-burst $burst_max_new_http_conn_per_second \ + -j ACCEPT + + if $log_rejected || $log_all ; then + $ip6t -A INPUT -p tcp -m multiport --dports 80,443 \ + --syn \ + -m limit --limit 10/second --limit-burst 20 \ + -j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow." + fi + + $ip6t -A INPUT -p tcp -m multiport --dports 80,443 \ + --syn \ + -j DROP + + echo_done + +else + + echo_skipped + fi -$ip6t -A INPUT -p tcp -m multiport --dports 80,443 \ - --syn \ - -j DROP - -echo_done echo ""