Configure limits for HTTPS connections.
This commit is contained in:
+128
-50
@@ -656,12 +656,43 @@ echo_skipped
|
||||
|
||||
echononl "\tAdjust IPv6 TCP MSS for HTTPS connections"
|
||||
|
||||
$ip6t -t mangle -A PREROUTING -i eth0 \
|
||||
-p tcp --dport 443 \
|
||||
--tcp-flags SYN,RST SYN \
|
||||
-j TCPMSS --set-mss 1360
|
||||
if $throttle_tcp6_mss_for_https ; then
|
||||
|
||||
echo_done
|
||||
if [[ -n "$tcp6_mss_for_https_val" ]] ; then
|
||||
|
||||
# Notice:
|
||||
#
|
||||
# - take care 'tcp6_mss_for_https_val' consists only of digits (is a natural number)
|
||||
#
|
||||
# - 1280 is the minimum IPv6 packet size that all routers must be able to process
|
||||
#
|
||||
if [[ "$tcp6_mss_for_https_val" =~ ^[0-9]+$ ]] ; then
|
||||
|
||||
if [[ "$tcp6_mss_for_https_val" -lt 1280 ]]; then
|
||||
|
||||
tcp6_mss_for_https_val=$min_tcp6_mss_for_https_val
|
||||
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
else
|
||||
|
||||
tcp6_mss_for_https_val=$min_tcp6_mss_for_https_val
|
||||
fi
|
||||
|
||||
$ip6t -t mangle -A PREROUTING -i eth0 \
|
||||
-p tcp --dport 443 \
|
||||
--tcp-flags SYN,RST SYN \
|
||||
-j TCPMSS --set-mss $tcp6_mss_for_https_val
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
|
||||
# ---
|
||||
@@ -2078,70 +2109,117 @@ echo_done
|
||||
# ---
|
||||
|
||||
echo ""
|
||||
echononl "\t\tA maximum of 30 new connections per second per IP"
|
||||
echononl "\t\tA maximum number new connections per second per IP"
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
if $set_max_new_http_conn_per_ip_per_second ; then
|
||||
|
||||
if [[ -z "$max_http_new_conn_per_ip_per_second" || ! "$max_http_new_conn_per_ip_per_second" =~ ^[0-9]+$ ]]; then
|
||||
|
||||
max_http_new_conn_per_ip_per_second=$default_max_http_new_conn_per_ip_per_second
|
||||
|
||||
fi
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
|
||||
-m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
|
||||
--hashlimit-above ${max_http_new_conn_per_ip_per_second}/second --hashlimit-burst 60 \
|
||||
--hashlimit-htable-expire 600000 \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then 30 new connections"
|
||||
fi
|
||||
|
||||
# HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen
|
||||
# Über 30 neue Verbindungen/s pro IP werden gedroppt
|
||||
# Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000).
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
|
||||
-m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
|
||||
--hashlimit-above 30/second --hashlimit-burst 60 \
|
||||
--hashlimit-htable-expire 600000 \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then 30 new connections"
|
||||
--hashlimit-above ${max_http_new_conn_per_ip_per_second}/second --hashlimit-burst 60 \
|
||||
--hashlimit-htable-expire 600000 -j DROP
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
# HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen
|
||||
# Über 30 neue Verbindungen/s pro IP werden gedroppt
|
||||
# Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000).
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
|
||||
-m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
|
||||
--hashlimit-above 30/second --hashlimit-burst 60 \
|
||||
--hashlimit-htable-expire 600000 -j DROP
|
||||
|
||||
echo_done
|
||||
echononl "\t\tA maximum number of concurrent TCP connections per IP"
|
||||
|
||||
|
||||
echononl "\t\tA maximum of 50 concurrent TCP connections per IP"
|
||||
if $set_max_concurrent_http_conn_per_ip ; then
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
if [[ -z "$max_concurrent_http_conn_per_ip" || ! "$max_concurrent_http_conn_per_ip" =~ ^[0-9]+$ ]]; then
|
||||
|
||||
max_concurrent_http_conn_per_ip=$default_max_concurrent_http_conn_per_ip
|
||||
|
||||
fi
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 --syn \
|
||||
-m connlimit --connlimit-above $max_concurrent_http_conn_per_ip --connlimit-mask 128 \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then 50 concurrent connections."
|
||||
fi
|
||||
|
||||
# HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen
|
||||
# Mehr als 50 parallele TCP-Verbindungen pro IP ablehnen
|
||||
#
|
||||
# Limit gilt pro einzelner IPv4-Adresse (--connlimit-mask 128) (z.bsp. 2a01:599:108:40b0:e1a9:170b:ba18:fd58/128)
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 --syn \
|
||||
-m connlimit --connlimit-above 50 --connlimit-mask 128 \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then 50 concurrent connections."
|
||||
-m connlimit --connlimit-above $max_concurrent_http_conn_per_ip --connlimit-mask 128 \
|
||||
-j REJECT --reject-with tcp-reset
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
# HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen
|
||||
# Mehr als 50 parallele TCP-Verbindungen pro IP ablehnen
|
||||
#
|
||||
# Limit gilt pro einzelner IPv4-Adresse (--connlimit-mask 128) (z.bsp. 2a01:599:108:40b0:e1a9:170b:ba18:fd58/128)
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 --syn \
|
||||
-m connlimit --connlimit-above 50 --connlimit-mask 128 \
|
||||
-j REJECT --reject-with tcp-reset
|
||||
|
||||
echo_done
|
||||
|
||||
|
||||
echononl "\t\tA maximum of 200 new TCP handshakes per second."
|
||||
echononl "\t\tA maximum number of new TCP handshakes per second."
|
||||
|
||||
# SYN-Rate begrenzen
|
||||
#
|
||||
# Kurzfristig auch bis zu 400 syn pakete erlaubt. --limit-burst 400 - Danach greift das Limit."
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 \
|
||||
--syn \
|
||||
-m limit --limit 200/second --limit-burst 400 \
|
||||
-j ACCEPT
|
||||
if $set_max_new_http_conn_per_second ; then
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
if [[ -z "$max_new_http_conn_per_second" || ! "$max_new_http_conn_per_second" =~ ^[0-9]+$ ]]; then
|
||||
|
||||
max_new_http_conn_per_second=$default_max_new_http_conn_per_second
|
||||
|
||||
fi
|
||||
|
||||
burst_max_new_http_conn_per_second=$((2 * max_new_http_conn_per_second))
|
||||
|
||||
# SYN-Rate begrenzen
|
||||
#
|
||||
# Kurzfristig auch bis zu 400 syn pakete erlaubt. --limit-burst 400 - Danach greift das Limit."
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 \
|
||||
--syn \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow."
|
||||
--syn \
|
||||
-m limit --limit ${max_new_http_conn_per_second}/second --limit-burst $burst_max_new_http_conn_per_second \
|
||||
-j ACCEPT
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 \
|
||||
--syn \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow."
|
||||
fi
|
||||
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 \
|
||||
--syn \
|
||||
-j DROP
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 \
|
||||
--syn \
|
||||
-j DROP
|
||||
|
||||
echo_done
|
||||
echo ""
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user