Configure limits for HTTPS connections.

conf/default_settings.conf

@@ -4,7 +4,7 @@
 # --- Default Parameter / Options
 # -------------
 
-default_per_IP_connection_limit=111
+default_per_IP_connection_limit=250
 
 
 # -------------
@@ -56,9 +56,9 @@ standard_prometheus_ports="9100,9256"
 
 # - Mattermost (MM) Service
 # -
-stansard_mattermost_udp_ports_in="8443"
+standard_mattermost_udp_ports_in="8443"
-stansard_mattermost_tcp_ports_in="8443"
+standard_mattermost_tcp_ports_in="8443"
-stansard_mattermost_udp_ports_out="3478"
+standard_mattermost_udp_ports_out="3478"
 
 # - IPsec - Internet Security Association and
 # -  Key Management Protocol
@@ -71,6 +71,26 @@ standard_ipsec_nat_t=4500
 standard_http_ports="80,443"
 standard_mailuser_ports="587,465,110,995,143,993"
 
+
+# ip6t-firewall-server:
+#     Clamp the advertised MSS of incoming HTTPS SYN packets to 1360.
+#
+throttle_tcp6_mss_for_https=false
+default_min_tcp6_mss_for_https_val=1280
+
+# ip6t-firewall-server,ipt-firewall-server:
+#     some restrictions on HTTP connections to counteract attacks.
+#
+set_max_new_http_conn_per_ip_per_second=true
+default_max_http_new_conn_per_ip_per_second=30
+
+set_max_concurrent_http_conn_per_ip=true
+default_max_concurrent_http_conn_per_ip=50
+
+set_max_new_http_conn_per_second=true
+default_max_new_http_conn_per_second=200
+
+
 # - Dovecot Service
 # -
 dovecot_external_auth_port="44444"

conf/main_ipv4.conf.sample

@@ -385,6 +385,24 @@ forward_http_server_ips=""
 # -
 http_ports="$standard_http_ports"
 
+# ip6t-firewall-server:
+#     Clamp the advertised MSS of incoming HTTPS SYN packets to 1360.
+#
+throttle_tcp6_mss_for_https=false
+tcp6_mss_for_https_val=${default_min_tcp6_mss_for_https_val}
+
+# ip6t-firewall-server,ipt-firewall-server:
+#     some restrictions on HTTP connections to counteract attacks.
+#
+set_max_new_http_conn_per_ip_per_second=true
+max_http_new_conn_per_ip_per_second=${default_max_http_new_conn_per_ip_per_second}
+
+set_max_concurrent_http_conn_per_ip=true
+max_concurrent_http_conn_per_ip=${default_max_concurrent_http_conn_per_ip}
+
+set_max_new_http_conn_per_second=true
+max_new_http_conn_per_second=${default_max_new_http_conn_per_second}
+
 
 # - LOG CGI script Traffic out
 # -
@@ -406,9 +424,9 @@ forward_mm_server_ips=""
 
 # - UDP Ports IN and OUT used by MM Servive
 # -
-mm_udp_ports_in="$stansard_mattermost_udp_ports_in"
+mm_udp_ports_in="$standard_mattermost_udp_ports_in"
-mm_tcp_ports_in="$stansard_mattermost_tcp_ports_in"
+mm_tcp_ports_in="$standard_mattermost_tcp_ports_in"
-mm_udp_ports_out="$stansard_mattermost_udp_ports_out"
+mm_udp_ports_out="$standard_mattermost_udp_ports_out"
 
 
 # - Mail SMTP Server 

conf/main_ipv6.conf.sample

@@ -401,6 +401,24 @@ forward_http_server_ips=""
 # -
 http_ports="$standard_http_ports"
 
+# ip6t-firewall-server:
+#     Clamp the advertised MSS of incoming HTTPS SYN packets to 1360.
+#
+throttle_tcp6_mss_for_https=false
+tcp6_mss_for_https_val=${default_min_tcp6_mss_for_https_val}
+
+# ip6t-firewall-server,ipt-firewall-server:
+#     some restrictions on HTTP connections to counteract attacks.
+#
+set_max_new_http_conn_per_ip_per_second=true
+max_http_new_conn_per_ip_per_second=${default_max_http_new_conn_per_ip_per_second}
+
+set_max_concurrent_http_conn_per_ip=true
+max_concurrent_http_conn_per_ip=${default_max_concurrent_http_conn_per_ip}
+
+set_max_new_http_conn_per_second=true
+max_new_http_conn_per_second=${default_max_new_http_conn_per_second}
+
 
 # - LOG CGI script Traffic out
 # -
@@ -422,9 +440,9 @@ forward_mm_server_ips=""
 
 # - UDP Ports IN and OUT used by MM Servive
 # -
-mm_udp_ports_in="$stansard_mattermost_udp_ports_in"
+mm_udp_ports_in="$standard_mattermost_udp_ports_in"
-mm_tcp_ports_in="$stansard_mattermost_tcp_ports_in"
+mm_tcp_ports_in="$standard_mattermost_tcp_ports_in"
-mm_udp_ports_out="$stansard_mattermost_udp_ports_out"
+mm_udp_ports_out="$standard_mattermost_udp_ports_out"
 
 
 # - Mail SMTP Server 

ip6t-firewall-server

@@ -656,12 +656,43 @@ echo_skipped
 
 echononl "\tAdjust IPv6 TCP MSS for HTTPS connections"
 
-$ip6t -t mangle -A PREROUTING -i eth0 \
+if $throttle_tcp6_mss_for_https ; then
-   -p tcp --dport 443 \
-   --tcp-flags SYN,RST SYN \
-   -j TCPMSS --set-mss 1360
 
-echo_done
+   if [[ -n "$tcp6_mss_for_https_val" ]] ; then
+
+      # Notice:
+      #
+      #  - take care 'tcp6_mss_for_https_val' consists only of digits (is a natural number)
+      #
+      #  - 1280 is the minimum IPv6 packet size that all routers must be able to process
+      #
+      if [[ "$tcp6_mss_for_https_val" =~ ^[0-9]+$ ]] ; then
+
+         if [[ "$tcp6_mss_for_https_val" -lt 1280 ]]; then
+
+            tcp6_mss_for_https_val=$min_tcp6_mss_for_https_val
+
+         fi
+
+      fi
+
+   else
+
+      tcp6_mss_for_https_val=$min_tcp6_mss_for_https_val
+   fi
+
+   $ip6t -t mangle -A PREROUTING -i eth0 \
+      -p tcp --dport 443 \
+      --tcp-flags SYN,RST SYN \
+      -j TCPMSS --set-mss $tcp6_mss_for_https_val
+
+   echo_done
+
+else
+
+   echo_skipped
+
+fi
 
 
 # ---
@@ -2078,70 +2109,117 @@ echo_done
 # ---
 
 echo ""
-echononl "\t\tA maximum of 30 new connections per second per IP"
+echononl "\t\tA maximum number new connections per second per IP"
 
-if $log_rejected || $log_all ; then
+if $set_max_new_http_conn_per_ip_per_second ; then
+
+   if [[ -z "$max_http_new_conn_per_ip_per_second" || ! "$max_http_new_conn_per_ip_per_second" =~ ^[0-9]+$ ]]; then
+
+      max_http_new_conn_per_ip_per_second=$default_max_http_new_conn_per_ip_per_second
+
+   fi
+
+   if $log_rejected || $log_all ; then
+      $ip6t -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
+      -m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
+      --hashlimit-above ${max_http_new_conn_per_ip_per_second}/second --hashlimit-burst 60 \
+      --hashlimit-htable-expire 600000 \
+      -m limit --limit 10/second --limit-burst 20 \
+      -j $LOG_TARGET $tag_log_prefix "$log_prefix more then 30 new connections"
+   fi
+
+   # HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen
+   # Über 30 neue Verbindungen/s pro IP werden gedroppt
+   # Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000).
    $ip6t -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
    -m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
-   --hashlimit-above 30/second --hashlimit-burst 60 \
+   --hashlimit-above ${max_http_new_conn_per_ip_per_second}/second --hashlimit-burst 60 \
-   --hashlimit-htable-expire 600000 \
+   --hashlimit-htable-expire 600000 -j DROP
-   -m limit --limit 10/second --limit-burst 20 \
+
-   -j $LOG_TARGET $tag_log_prefix "$log_prefix more then 30 new connections"
+   echo_done
+
+else
+
+   echo_skipped
+
 fi
 
-# HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen
-# Über 30 neue Verbindungen/s pro IP werden gedroppt
-# Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000).
-$ip6t -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
-  -m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
-  --hashlimit-above 30/second --hashlimit-burst 60 \
-  --hashlimit-htable-expire 600000 -j DROP
 
-echo_done
+echononl "\t\tA maximum number of concurrent TCP connections per IP"
 
 
-echononl "\t\tA maximum of 50 concurrent TCP connections per IP"
+if $set_max_concurrent_http_conn_per_ip ; then
 
-if $log_rejected || $log_all ; then
+   if [[ -z "$max_concurrent_http_conn_per_ip" || ! "$max_concurrent_http_conn_per_ip" =~ ^[0-9]+$ ]]; then
+
+      max_concurrent_http_conn_per_ip=$default_max_concurrent_http_conn_per_ip
+
+   fi
+
+   if $log_rejected || $log_all ; then
+      $ip6t -A INPUT -p tcp -m multiport --dports 80,443 --syn \
+      -m connlimit --connlimit-above $max_concurrent_http_conn_per_ip --connlimit-mask 128 \
+      -m limit --limit 10/second --limit-burst 20 \
+      -j $LOG_TARGET $tag_log_prefix "$log_prefix more then 50 concurrent connections."
+   fi
+
+   # HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen
+   # Mehr als 50 parallele TCP-Verbindungen pro IP ablehnen
+   #
+   # Limit gilt pro einzelner IPv4-Adresse (--connlimit-mask 128) (z.bsp.  2a01:599:108:40b0:e1a9:170b:ba18:fd58/128)
    $ip6t -A INPUT -p tcp -m multiport --dports 80,443 --syn \
-   -m connlimit --connlimit-above 50 --connlimit-mask 128 \
+   -m connlimit --connlimit-above $max_concurrent_http_conn_per_ip --connlimit-mask 128 \
-   -m limit --limit 10/second --limit-burst 20 \
+   -j REJECT --reject-with tcp-reset
-   -j $LOG_TARGET $tag_log_prefix "$log_prefix more then 50 concurrent connections."
+
+   echo_done
+
+else
+
+   echo_skipped
+
 fi
 
-# HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen
-# Mehr als 50 parallele TCP-Verbindungen pro IP ablehnen
-#
-# Limit gilt pro einzelner IPv4-Adresse (--connlimit-mask 128) (z.bsp.  2a01:599:108:40b0:e1a9:170b:ba18:fd58/128)
-$ip6t -A INPUT -p tcp -m multiport --dports 80,443 --syn \
-  -m connlimit --connlimit-above 50 --connlimit-mask 128 \
-  -j REJECT --reject-with tcp-reset
-
-echo_done
 
 
-echononl "\t\tA maximum of 200 new TCP handshakes per second."
+echononl "\t\tA maximum number of new TCP handshakes per second."
 
-# SYN-Rate begrenzen
+if $set_max_new_http_conn_per_second ; then
-#
-# Kurzfristig auch bis zu 400 syn pakete erlaubt. --limit-burst 400 - Danach greift das Limit."
-$ip6t -A INPUT -p tcp -m multiport --dports 80,443 \
-   --syn \
-   -m limit --limit 200/second --limit-burst 400 \
-   -j ACCEPT
 
-if $log_rejected || $log_all ; then
+   if [[ -z "$max_new_http_conn_per_second" || ! "$max_new_http_conn_per_second" =~ ^[0-9]+$ ]]; then
+
+      max_new_http_conn_per_second=$default_max_new_http_conn_per_second
+
+   fi
+
+   burst_max_new_http_conn_per_second=$((2 * max_new_http_conn_per_second))
+
+   # SYN-Rate begrenzen
+   #
+   # Kurzfristig auch bis zu 400 syn pakete erlaubt. --limit-burst 400 - Danach greift das Limit."
    $ip6t -A INPUT -p tcp -m multiport --dports 80,443 \
-   --syn \
+      --syn \
-   -m limit --limit 10/second --limit-burst 20 \
+      -m limit --limit ${max_new_http_conn_per_second}/second --limit-burst $burst_max_new_http_conn_per_second \
-   -j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow."
+      -j ACCEPT
+
+   if $log_rejected || $log_all ; then
+      $ip6t -A INPUT -p tcp -m multiport --dports 80,443 \
+      --syn \
+      -m limit --limit 10/second --limit-burst 20 \
+      -j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow."
+   fi
+
+   $ip6t -A INPUT -p tcp -m multiport --dports 80,443 \
+      --syn \
+      -j DROP
+
+   echo_done
+
+else
+
+   echo_skipped
+
 fi
 
-$ip6t -A INPUT -p tcp -m multiport --dports 80,443 \
-   --syn \
-   -j DROP
-
-echo_done
 echo ""