firewall/ipt-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ip6t-firewall-server,ipt-firewall-server,default_settings.conf: some changes in default values limiting http connections.

Browse Source
This commit is contained in:
chris
2026-11-02 18:10:26 +01:00
parent 57861cb8ec
commit 9de4e742cd
3 changed files with 111 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ip6t-firewall-server
+9 -5
View File
@@ -2179,13 +2179,16 @@ if $set_max_new_http_conn_per_ip_per_second ; then
fi
burst_http_new_conn_per_ip_per_second=$((max_http_new_conn_per_ip_per_second * 2))
if $log_rejected || $log_all ; then
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
-m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
--hashlimit-above ${max_http_new_conn_per_ip_per_second}/second --hashlimit-burst 60 \
--hashlimit-above ${max_http_new_conn_per_ip_per_second}/second \
--hashlimit-burst $burst_http_new_conn_per_ip_per_second \
--hashlimit-htable-expire 600000 \
-m limit --limit 10/second --limit-burst 20 \
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then 30 new connections"
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then $max_http_new_conn_per_ip_per_second new connections per second"
fi
# HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen
@@ -2193,7 +2196,8 @@ if $set_max_new_http_conn_per_ip_per_second ; then
# Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000).
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
-m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
--hashlimit-above ${max_http_new_conn_per_ip_per_second}/second --hashlimit-burst 60 \
--hashlimit-above ${max_http_new_conn_per_ip_per_second}/second \
--hashlimit-burst $burst_http_new_conn_per_ip_per_second \
--hashlimit-htable-expire 600000 -j DROP
echo_done
@@ -2220,7 +2224,7 @@ if $set_max_concurrent_http_conn_per_ip ; then
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 --syn \
-m connlimit --connlimit-above $max_concurrent_http_conn_per_ip --connlimit-mask 128 \
-m limit --limit 10/second --limit-burst 20 \
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then 50 concurrent connections."
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then $max_concurrent_http_conn_per_ip concurrent connections per IP."
fi
# HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen
@@ -2264,7 +2268,7 @@ if $set_max_new_http_conn_per_second ; then
if $log_rejected || $log_all ; then
$ip6t -A INPUT -p tcp -m multiport --dports 80,443 \
--syn \
-m limit --limit 10/second --limit-burst 20 \
-m limit --limit ${max_new_http_conn_per_second}/second --limit-burst $burst_max_new_http_conn_per_second \
-j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow."
fi