ip6t-firewall-server,ipt-firewall-server,default_settings.conf: some changes in default values limiting http connections.
This commit is contained in:
+93
-44
@@ -2247,70 +2247,119 @@ echo_done
|
||||
# ---
|
||||
|
||||
echo ""
|
||||
echononl "\t\tA maximum of 30 new connections per second per IP"
|
||||
echononl "\t\tA maximum number new connections per second per IP"
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
if $set_max_new_http_conn_per_ip_per_second ; then
|
||||
|
||||
if [[ -z "$max_http_new_conn_per_ip_per_second" || ! "$max_http_new_conn_per_ip_per_second" =~ ^[0-9]+$ ]]; then
|
||||
|
||||
max_http_new_conn_per_ip_per_second=$default_max_http_new_conn_per_ip_per_second
|
||||
|
||||
fi
|
||||
|
||||
burst_http_new_conn_per_ip_per_second=$((max_http_new_conn_per_ip_per_second * 2))
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
$ipt -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
|
||||
-m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
|
||||
--hashlimit-above ${max_http_new_conn_per_ip_per_second}/second \
|
||||
--hashlimit-burst $burst_http_new_conn_per_ip_per_second \
|
||||
--hashlimit-htable-expire 600000 \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then $max_http_new_conn_per_ip_per_second new connections per second"
|
||||
fi
|
||||
|
||||
# HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen
|
||||
# Über 30 neue Verbindungen/s pro IP werden gedroppt
|
||||
# Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000).
|
||||
$ipt -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
|
||||
-m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
|
||||
--hashlimit-above 30/second --hashlimit-burst 60 \
|
||||
--hashlimit-htable-expire 600000 \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then 30 new connections"
|
||||
--hashlimit-above ${max_http_new_conn_per_ip_per_second}/second \
|
||||
--hashlimit-burst $burst_http_new_conn_per_ip_per_second \
|
||||
--hashlimit-htable-expire 600000 -j DROP
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
# HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen
|
||||
# Über 30 neue Verbindungen/s pro IP werden gedroppt
|
||||
# Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000).
|
||||
$ipt -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
|
||||
-m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
|
||||
--hashlimit-above 30/second --hashlimit-burst 60 \
|
||||
--hashlimit-htable-expire 600000 -j DROP
|
||||
|
||||
echo_done
|
||||
echononl "\t\tA maximum number of concurrent TCP connections per IP"
|
||||
|
||||
if $set_max_concurrent_http_conn_per_ip ; then
|
||||
|
||||
echononl "\t\tA maximum of 50 concurrent TCP connections per IP"
|
||||
if [[ -z "$max_concurrent_http_conn_per_ip" || ! "$max_concurrent_http_conn_per_ip" =~ ^[0-9]+$ ]]; then
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
max_concurrent_http_conn_per_ip=$default_max_concurrent_http_conn_per_ip
|
||||
|
||||
fi
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
$ipt -A INPUT -p tcp -m multiport --dports 80,443 --syn \
|
||||
-m connlimit --connlimit-above $max_concurrent_http_conn_per_ip --connlimit-mask 128 \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then $max_concurrent_http_conn_per_ip concurrent connections per IP."
|
||||
fi
|
||||
|
||||
# HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen
|
||||
# Mehr als 50 parallele TCP-Verbindungen pro IP ablehnen
|
||||
#
|
||||
# Limit gilt pro einzelner IPv4-Adresse (--connlimit-mask 128) (z.bsp. 2a01:599:108:40b0:e1a9:170b:ba18:fd58/128)
|
||||
$ipt -A INPUT -p tcp -m multiport --dports 80,443 --syn \
|
||||
-m connlimit --connlimit-above 50 --connlimit-mask 128 \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix more then 50 concurrent connections."
|
||||
-m connlimit --connlimit-above $max_concurrent_http_conn_per_ip --connlimit-mask 128 \
|
||||
-j REJECT --reject-with tcp-reset
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
# HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen
|
||||
# Mehr als 50 parallele TCP-Verbindungen pro IP ablehnen
|
||||
#
|
||||
# Limit gilt pro einzelner IPv4-Adresse (--connlimit-mask 128) (z.bsp. 2a01:599:108:40b0:e1a9:170b:ba18:fd58/128)
|
||||
$ipt -A INPUT -p tcp -m multiport --dports 80,443 --syn \
|
||||
-m connlimit --connlimit-above 50 --connlimit-mask 128 \
|
||||
-j REJECT --reject-with tcp-reset
|
||||
|
||||
echo_done
|
||||
echononl "\t\tA maximum number of new TCP handshakes per second."
|
||||
|
||||
if $set_max_new_http_conn_per_second ; then
|
||||
|
||||
echononl "\t\tA maximum of 200 new TCP handshakes per second."
|
||||
if [[ -z "$max_new_http_conn_per_second" || ! "$max_new_http_conn_per_second" =~ ^[0-9]+$ ]]; then
|
||||
|
||||
# SYN-Rate begrenzen
|
||||
#
|
||||
# Kurzfristig auch bis zu 400 syn pakete erlaubt. --limit-burst 400 - Danach greift das Limit."
|
||||
$ipt -A INPUT -p tcp -m multiport --dports 80,443 \
|
||||
--syn \
|
||||
-m limit --limit 200/second --limit-burst 400 \
|
||||
-j ACCEPT
|
||||
max_new_http_conn_per_second=$default_max_new_http_conn_per_second
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
fi
|
||||
|
||||
burst_max_new_http_conn_per_second=$((2 * max_new_http_conn_per_second))
|
||||
|
||||
# SYN-Rate begrenzen
|
||||
#
|
||||
# Kurzfristig auch bis zu 400 syn pakete erlaubt. --limit-burst 400 - Danach greift das Limit."
|
||||
$ipt -A INPUT -p tcp -m multiport --dports 80,443 \
|
||||
--syn \
|
||||
-m limit --limit 10/second --limit-burst 20 \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow."
|
||||
--syn \
|
||||
-m limit --limit ${max_new_http_conn_per_second}/second --limit-burst $burst_max_new_http_conn_per_second \
|
||||
-j ACCEPT
|
||||
|
||||
if $log_rejected || $log_all ; then
|
||||
$ipt -A INPUT -p tcp -m multiport --dports 80,443 \
|
||||
--syn \
|
||||
-m limit --limit ${max_new_http_conn_per_second}/second --limit-burst $burst_max_new_http_conn_per_second \
|
||||
-j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow."
|
||||
fi
|
||||
|
||||
$ipt -A INPUT -p tcp -m multiport --dports 80,443 \
|
||||
--syn \
|
||||
-j DROP
|
||||
|
||||
echo_done
|
||||
|
||||
else
|
||||
|
||||
echo_skipped
|
||||
|
||||
fi
|
||||
|
||||
$ipt -A INPUT -p tcp -m multiport --dports 80,443 \
|
||||
--syn \
|
||||
-j DROP
|
||||
|
||||
echo_done
|
||||
echo ""
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user