firewall/ipt-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Configure limits for HTTPS connections.

Browse Source
This commit is contained in:
chris
2026-10-27 21:18:02 +01:00
parent 560ee66b07
commit 792d0b1b86
4 changed files with 200 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/default_settings.conf
+30 -10
View File
@@ -4,7 +4,7 @@
# --- Default Parameter / Options
# -------------
default_per_IP_connection_limit=111
default_per_IP_connection_limit=250
# -------------
@@ -56,9 +56,9 @@ standard_prometheus_ports="9100,9256"
# - Mattermost (MM) Service
# -
stansard_mattermost_udp_ports_in="8443"
stansard_mattermost_tcp_ports_in="8443"
stansard_mattermost_udp_ports_out="3478"
standard_mattermost_udp_ports_in="8443"
standard_mattermost_tcp_ports_in="8443"
standard_mattermost_udp_ports_out="3478"
# - IPsec - Internet Security Association and
# - Key Management Protocol
@@ -71,6 +71,26 @@ standard_ipsec_nat_t=4500
standard_http_ports="80,443"
standard_mailuser_ports="587,465,110,995,143,993"
# ip6t-firewall-server:
# Clamp the advertised MSS of incoming HTTPS SYN packets to 1360.
#
throttle_tcp6_mss_for_https=false
default_min_tcp6_mss_for_https_val=1280
# ip6t-firewall-server,ipt-firewall-server:
# some restrictions on HTTP connections to counteract attacks.
#
set_max_new_http_conn_per_ip_per_second=true
default_max_http_new_conn_per_ip_per_second=30
set_max_concurrent_http_conn_per_ip=true
default_max_concurrent_http_conn_per_ip=50
set_max_new_http_conn_per_second=true
default_max_new_http_conn_per_second=200
# - Dovecot Service
# -
dovecot_external_auth_port="44444"
@@ -86,20 +106,20 @@ default_jitsi_dovecout_auth_port="$dovecot_external_auth_port"
default_jibri_out_port=5222
# default_outbound_streaming_tcp_ports
#
# - outbound port 1935/TCP : outbound streaming over RTMP to most
# - outbound port 1935/TCP : outbound streaming over RTMP to most
# streaming providers such as YouTube Live, Vimeo or Twitch
#
# - outbound port 1936/TCP : outbound streaming over RTMP to LinkedIn
# - outbound port 1936/TCP : outbound streaming over RTMP to LinkedIn
# Live (port 1935 is also used for RTMP streaming to LinkedIn)
#
# - outbound ports 2935/TCP and 2396/TCP : outbound streaming over
# - outbound ports 2935/TCP and 2396/TCP : outbound streaming over
# RTMPS to LinkedIn Live
#
# - outbound port 443/TCP (HTTPS) : used for authentication with the
# built-in providers such as YouTube Live, Facebook Live, Ustream,
# - outbound port 443/TCP (HTTPS) : used for authentication with the
# built-in providers such as YouTube Live, Facebook Live, Ustream,
# Livestream, and Twitch
#
# - outbound port 53/UDP (DNS) used for DNS lookups converting
# - outbound port 53/UDP (DNS) used for DNS lookups converting
# hostnames to IP addresses
#
default_outbound_streaming_tcp_ports="1935,1936,2935,2396"
conf/main_ipv4.conf.sample
+21 -3
View File
@@ -385,6 +385,24 @@ forward_http_server_ips=""
# -
http_ports="$standard_http_ports"
# ip6t-firewall-server:
# Clamp the advertised MSS of incoming HTTPS SYN packets to 1360.
#
throttle_tcp6_mss_for_https=false
tcp6_mss_for_https_val=${default_min_tcp6_mss_for_https_val}
# ip6t-firewall-server,ipt-firewall-server:
# some restrictions on HTTP connections to counteract attacks.
#
set_max_new_http_conn_per_ip_per_second=true
max_http_new_conn_per_ip_per_second=${default_max_http_new_conn_per_ip_per_second}
set_max_concurrent_http_conn_per_ip=true
max_concurrent_http_conn_per_ip=${default_max_concurrent_http_conn_per_ip}
set_max_new_http_conn_per_second=true
max_new_http_conn_per_second=${default_max_new_http_conn_per_second}
# - LOG CGI script Traffic out
# -
@@ -406,9 +424,9 @@ forward_mm_server_ips=""
# - UDP Ports IN and OUT used by MM Servive
# -
mm_udp_ports_in="$stansard_mattermost_udp_ports_in"
mm_tcp_ports_in="$stansard_mattermost_tcp_ports_in"
mm_udp_ports_out="$stansard_mattermost_udp_ports_out"
mm_udp_ports_in="$standard_mattermost_udp_ports_in"
mm_tcp_ports_in="$standard_mattermost_tcp_ports_in"
mm_udp_ports_out="$standard_mattermost_udp_ports_out"
# - Mail SMTP Server
conf/main_ipv6.conf.sample
+21 -3
View File
@@ -401,6 +401,24 @@ forward_http_server_ips=""
# -
http_ports="$standard_http_ports"
# ip6t-firewall-server:
# Clamp the advertised MSS of incoming HTTPS SYN packets to 1360.
#
throttle_tcp6_mss_for_https=false
tcp6_mss_for_https_val=${default_min_tcp6_mss_for_https_val}
# ip6t-firewall-server,ipt-firewall-server:
# some restrictions on HTTP connections to counteract attacks.
#
set_max_new_http_conn_per_ip_per_second=true
max_http_new_conn_per_ip_per_second=${default_max_http_new_conn_per_ip_per_second}
set_max_concurrent_http_conn_per_ip=true
max_concurrent_http_conn_per_ip=${default_max_concurrent_http_conn_per_ip}
set_max_new_http_conn_per_second=true
max_new_http_conn_per_second=${default_max_new_http_conn_per_second}
# - LOG CGI script Traffic out
# -
@@ -422,9 +440,9 @@ forward_mm_server_ips=""
# - UDP Ports IN and OUT used by MM Servive
# -
mm_udp_ports_in="$stansard_mattermost_udp_ports_in"
mm_tcp_ports_in="$stansard_mattermost_tcp_ports_in"
mm_udp_ports_out="$stansard_mattermost_udp_ports_out"
mm_udp_ports_in="$standard_mattermost_udp_ports_in"
mm_tcp_ports_in="$standard_mattermost_tcp_ports_in"
mm_udp_ports_out="$standard_mattermost_udp_ports_out"
# - Mail SMTP Server