Configure limits for HTTPS connections.
This commit is contained in:
@@ -4,7 +4,7 @@
|
||||
# --- Default Parameter / Options
|
||||
# -------------
|
||||
|
||||
default_per_IP_connection_limit=111
|
||||
default_per_IP_connection_limit=250
|
||||
|
||||
|
||||
# -------------
|
||||
@@ -56,9 +56,9 @@ standard_prometheus_ports="9100,9256"
|
||||
|
||||
# - Mattermost (MM) Service
|
||||
# -
|
||||
stansard_mattermost_udp_ports_in="8443"
|
||||
stansard_mattermost_tcp_ports_in="8443"
|
||||
stansard_mattermost_udp_ports_out="3478"
|
||||
standard_mattermost_udp_ports_in="8443"
|
||||
standard_mattermost_tcp_ports_in="8443"
|
||||
standard_mattermost_udp_ports_out="3478"
|
||||
|
||||
# - IPsec - Internet Security Association and
|
||||
# - Key Management Protocol
|
||||
@@ -71,6 +71,26 @@ standard_ipsec_nat_t=4500
|
||||
standard_http_ports="80,443"
|
||||
standard_mailuser_ports="587,465,110,995,143,993"
|
||||
|
||||
|
||||
# ip6t-firewall-server:
|
||||
# Clamp the advertised MSS of incoming HTTPS SYN packets to 1360.
|
||||
#
|
||||
throttle_tcp6_mss_for_https=false
|
||||
default_min_tcp6_mss_for_https_val=1280
|
||||
|
||||
# ip6t-firewall-server,ipt-firewall-server:
|
||||
# some restrictions on HTTP connections to counteract attacks.
|
||||
#
|
||||
set_max_new_http_conn_per_ip_per_second=true
|
||||
default_max_http_new_conn_per_ip_per_second=30
|
||||
|
||||
set_max_concurrent_http_conn_per_ip=true
|
||||
default_max_concurrent_http_conn_per_ip=50
|
||||
|
||||
set_max_new_http_conn_per_second=true
|
||||
default_max_new_http_conn_per_second=200
|
||||
|
||||
|
||||
# - Dovecot Service
|
||||
# -
|
||||
dovecot_external_auth_port="44444"
|
||||
|
||||
@@ -385,6 +385,24 @@ forward_http_server_ips=""
|
||||
# -
|
||||
http_ports="$standard_http_ports"
|
||||
|
||||
# ip6t-firewall-server:
|
||||
# Clamp the advertised MSS of incoming HTTPS SYN packets to 1360.
|
||||
#
|
||||
throttle_tcp6_mss_for_https=false
|
||||
tcp6_mss_for_https_val=${default_min_tcp6_mss_for_https_val}
|
||||
|
||||
# ip6t-firewall-server,ipt-firewall-server:
|
||||
# some restrictions on HTTP connections to counteract attacks.
|
||||
#
|
||||
set_max_new_http_conn_per_ip_per_second=true
|
||||
max_http_new_conn_per_ip_per_second=${default_max_http_new_conn_per_ip_per_second}
|
||||
|
||||
set_max_concurrent_http_conn_per_ip=true
|
||||
max_concurrent_http_conn_per_ip=${default_max_concurrent_http_conn_per_ip}
|
||||
|
||||
set_max_new_http_conn_per_second=true
|
||||
max_new_http_conn_per_second=${default_max_new_http_conn_per_second}
|
||||
|
||||
|
||||
# - LOG CGI script Traffic out
|
||||
# -
|
||||
@@ -406,9 +424,9 @@ forward_mm_server_ips=""
|
||||
|
||||
# - UDP Ports IN and OUT used by MM Servive
|
||||
# -
|
||||
mm_udp_ports_in="$stansard_mattermost_udp_ports_in"
|
||||
mm_tcp_ports_in="$stansard_mattermost_tcp_ports_in"
|
||||
mm_udp_ports_out="$stansard_mattermost_udp_ports_out"
|
||||
mm_udp_ports_in="$standard_mattermost_udp_ports_in"
|
||||
mm_tcp_ports_in="$standard_mattermost_tcp_ports_in"
|
||||
mm_udp_ports_out="$standard_mattermost_udp_ports_out"
|
||||
|
||||
|
||||
# - Mail SMTP Server
|
||||
|
||||
@@ -401,6 +401,24 @@ forward_http_server_ips=""
|
||||
# -
|
||||
http_ports="$standard_http_ports"
|
||||
|
||||
# ip6t-firewall-server:
|
||||
# Clamp the advertised MSS of incoming HTTPS SYN packets to 1360.
|
||||
#
|
||||
throttle_tcp6_mss_for_https=false
|
||||
tcp6_mss_for_https_val=${default_min_tcp6_mss_for_https_val}
|
||||
|
||||
# ip6t-firewall-server,ipt-firewall-server:
|
||||
# some restrictions on HTTP connections to counteract attacks.
|
||||
#
|
||||
set_max_new_http_conn_per_ip_per_second=true
|
||||
max_http_new_conn_per_ip_per_second=${default_max_http_new_conn_per_ip_per_second}
|
||||
|
||||
set_max_concurrent_http_conn_per_ip=true
|
||||
max_concurrent_http_conn_per_ip=${default_max_concurrent_http_conn_per_ip}
|
||||
|
||||
set_max_new_http_conn_per_second=true
|
||||
max_new_http_conn_per_second=${default_max_new_http_conn_per_second}
|
||||
|
||||
|
||||
# - LOG CGI script Traffic out
|
||||
# -
|
||||
@@ -422,9 +440,9 @@ forward_mm_server_ips=""
|
||||
|
||||
# - UDP Ports IN and OUT used by MM Servive
|
||||
# -
|
||||
mm_udp_ports_in="$stansard_mattermost_udp_ports_in"
|
||||
mm_tcp_ports_in="$stansard_mattermost_tcp_ports_in"
|
||||
mm_udp_ports_out="$stansard_mattermost_udp_ports_out"
|
||||
mm_udp_ports_in="$standard_mattermost_udp_ports_in"
|
||||
mm_tcp_ports_in="$standard_mattermost_tcp_ports_in"
|
||||
mm_udp_ports_out="$standard_mattermost_udp_ports_out"
|
||||
|
||||
|
||||
# - Mail SMTP Server
|
||||
|
||||
+128
-50
@@ -656,12 +656,43 @@ echo_skipped
|
||||
|
||||
echononl "\tAdjust IPv6 TCP MSS for HTTPS connections"
|
||||
|
||||
$ip6t -t mangle -A PREROUTING -i eth0 \
|
||||
-p tcp --dport 443 \
|
||||
--tcp-flags SYN,RST SYN \
|
||||
-j TCPMSS --set-mss 1360
|
||||
if $throttle_tcp6_mss_for_https ; then
|
||||
|
||||
echo_done
|
||||
if [[ -n "$tcp6_mss_for_https_val" ]] ; then
|
||||
|
||||
# Notice:
|
||||
#
|
||||
# - take care 'tcp6_mss_for_https_val' consists only of digits (is a natural number)
|
||||
#
|
||||
# - 1280 is the minimum IPv6 packet size that all routers must be able to process
|
||||
#
|
||||
if [[ "$tcp6_mss_for_https_val" =~ ^[0-9]+$ ]] ; then
|
||||
|
||||
if [[ "$tcp6_mss_for_https_val" -lt 1280 ]]; then
|
||||
|
||||
tcp6_mss_for_https_val=$min_tcp6_mss_for_https_val
|
||||
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
else
|
||||
|
||||
tcp6_mss_for_https_val=$min_tcp6_mss_for_https_val
|
||||
fi
|
||||
|
||||
$ip6t -t mangle -A PREROUTING -i eth0 \
|
||||
-p tcp --dport 443 \
|
||||
--tcp-flags SYN,RST SYN \
|
||||
-j TCPMSS --set-mss $tcp6_mss_for_https_val
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
|
||||
# ---
|
||||
@@ -2078,70 +2109,117 @@ echo_done
|
||||
# ---
|
||||
|
||||
echo ""
|
||||
echononl "\t\tA maximum of 30 new connections per second per IP"
|
||||
echononl "\t\tA maximum number new connections per second per IP"
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
if $set_max_new_http_conn_per_ip_per_second ; then
|
||||
|
||||
if [[ -z "$max_http_new_conn_per_ip_per_second" || ! "$max_http_new_conn_per_ip_per_second" =~ ^[0-9]+$ ]]; then
|
||||
|
||||
max_http_new_conn_per_ip_per_second=$default_max_http_new_conn_per_ip_per_second
|
||||
|
||||
fi
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
|
||||
-m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
|
||||
--hashlimit-above ${max_http_new_conn_per_ip_per_second}/second --hashlimit-burst 60 \
|
||||
--hashlimit-htable-expire 600000 \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then 30 new connections"
|
||||
fi
|
||||
|
||||
# HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen
|
||||
# Über 30 neue Verbindungen/s pro IP werden gedroppt
|
||||
# Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000).
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
|
||||
-m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
|
||||
--hashlimit-above 30/second --hashlimit-burst 60 \
|
||||
--hashlimit-htable-expire 600000 \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then 30 new connections"
|
||||
--hashlimit-above ${max_http_new_conn_per_ip_per_second}/second --hashlimit-burst 60 \
|
||||
--hashlimit-htable-expire 600000 -j DROP
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
# HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen
|
||||
# Über 30 neue Verbindungen/s pro IP werden gedroppt
|
||||
# Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000).
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
|
||||
-m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
|
||||
--hashlimit-above 30/second --hashlimit-burst 60 \
|
||||
--hashlimit-htable-expire 600000 -j DROP
|
||||
|
||||
echo_done
|
||||
echononl "\t\tA maximum number of concurrent TCP connections per IP"
|
||||
|
||||
|
||||
echononl "\t\tA maximum of 50 concurrent TCP connections per IP"
|
||||
if $set_max_concurrent_http_conn_per_ip ; then
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
if [[ -z "$max_concurrent_http_conn_per_ip" || ! "$max_concurrent_http_conn_per_ip" =~ ^[0-9]+$ ]]; then
|
||||
|
||||
max_concurrent_http_conn_per_ip=$default_max_concurrent_http_conn_per_ip
|
||||
|
||||
fi
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 --syn \
|
||||
-m connlimit --connlimit-above $max_concurrent_http_conn_per_ip --connlimit-mask 128 \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then 50 concurrent connections."
|
||||
fi
|
||||
|
||||
# HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen
|
||||
# Mehr als 50 parallele TCP-Verbindungen pro IP ablehnen
|
||||
#
|
||||
# Limit gilt pro einzelner IPv4-Adresse (--connlimit-mask 128) (z.bsp. 2a01:599:108:40b0:e1a9:170b:ba18:fd58/128)
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 --syn \
|
||||
-m connlimit --connlimit-above 50 --connlimit-mask 128 \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then 50 concurrent connections."
|
||||
-m connlimit --connlimit-above $max_concurrent_http_conn_per_ip --connlimit-mask 128 \
|
||||
-j REJECT --reject-with tcp-reset
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
# HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen
|
||||
# Mehr als 50 parallele TCP-Verbindungen pro IP ablehnen
|
||||
#
|
||||
# Limit gilt pro einzelner IPv4-Adresse (--connlimit-mask 128) (z.bsp. 2a01:599:108:40b0:e1a9:170b:ba18:fd58/128)
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 --syn \
|
||||
-m connlimit --connlimit-above 50 --connlimit-mask 128 \
|
||||
-j REJECT --reject-with tcp-reset
|
||||
|
||||
echo_done
|
||||
|
||||
|
||||
echononl "\t\tA maximum of 200 new TCP handshakes per second."
|
||||
echononl "\t\tA maximum number of new TCP handshakes per second."
|
||||
|
||||
# SYN-Rate begrenzen
|
||||
#
|
||||
# Kurzfristig auch bis zu 400 syn pakete erlaubt. --limit-burst 400 - Danach greift das Limit."
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 \
|
||||
--syn \
|
||||
-m limit --limit 200/second --limit-burst 400 \
|
||||
-j ACCEPT
|
||||
if $set_max_new_http_conn_per_second ; then
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
if [[ -z "$max_new_http_conn_per_second" || ! "$max_new_http_conn_per_second" =~ ^[0-9]+$ ]]; then
|
||||
|
||||
max_new_http_conn_per_second=$default_max_new_http_conn_per_second
|
||||
|
||||
fi
|
||||
|
||||
burst_max_new_http_conn_per_second=$((2 * max_new_http_conn_per_second))
|
||||
|
||||
# SYN-Rate begrenzen
|
||||
#
|
||||
# Kurzfristig auch bis zu 400 syn pakete erlaubt. --limit-burst 400 - Danach greift das Limit."
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 \
|
||||
--syn \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow."
|
||||
--syn \
|
||||
-m limit --limit ${max_new_http_conn_per_second}/second --limit-burst $burst_max_new_http_conn_per_second \
|
||||
-j ACCEPT
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 \
|
||||
--syn \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow."
|
||||
fi
|
||||
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 \
|
||||
--syn \
|
||||
-j DROP
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 \
|
||||
--syn \
|
||||
-j DROP
|
||||
|
||||
echo_done
|
||||
echo ""
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user