ip6t-firewall-server,ipt-firewall-server,default_settings.conf: some changes in default values limiting http connections.

conf/default_settings.conf

@@ -81,14 +81,20 @@ min_tcp6_mss_for_https_val=1280
 # ip6t-firewall-server,ipt-firewall-server:
 #     some restrictions on HTTP connections to counteract attacks.
 #
+# The default value used to be set to '30'
+#
 set_max_new_http_conn_per_ip_per_second=true
-default_max_http_new_conn_per_ip_per_second=30
+default_max_http_new_conn_per_ip_per_second=200
 
+# The default value used to be set to '50'
+#
 set_max_concurrent_http_conn_per_ip=true
-default_max_concurrent_http_conn_per_ip=50
+default_max_concurrent_http_conn_per_ip=100
 
+# The default value used to be set to '200'
+#
 set_max_new_http_conn_per_second=true
-default_max_new_http_conn_per_second=200
+default_max_new_http_conn_per_second=400
 
 # ip6t-firewall-server:
 #     Prefix length for entries in 'ban_ipv6.list' given without mask.

ip6t-firewall-server

@@ -2179,13 +2179,16 @@ if $set_max_new_http_conn_per_ip_per_second ; then
 
    fi
 
+   burst_http_new_conn_per_ip_per_second=$((max_http_new_conn_per_ip_per_second * 2))
+
    if $log_rejected || $log_all ; then
       $ip6t -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
       -m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
-      --hashlimit-above ${max_http_new_conn_per_ip_per_second}/second --hashlimit-burst 60 \
+      --hashlimit-above ${max_http_new_conn_per_ip_per_second}/second \
+      --hashlimit-burst $burst_http_new_conn_per_ip_per_second \
       --hashlimit-htable-expire 600000 \
       -m limit --limit 10/second --limit-burst 20 \
-      -j $LOG_TARGET $tag_log_prefix "$log_prefix more then 30 new connections"
+      -j $LOG_TARGET $tag_log_prefix "$log_prefix more then $max_http_new_conn_per_ip_per_second new connections per second"
    fi
 
    # HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen
@@ -2193,7 +2196,8 @@ if $set_max_new_http_conn_per_ip_per_second ; then
    # Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000).
    $ip6t -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
    -m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
-   --hashlimit-above ${max_http_new_conn_per_ip_per_second}/second --hashlimit-burst 60 \
+   --hashlimit-above ${max_http_new_conn_per_ip_per_second}/second \
+   --hashlimit-burst $burst_http_new_conn_per_ip_per_second  \
    --hashlimit-htable-expire 600000 -j DROP
 
    echo_done
@@ -2220,7 +2224,7 @@ if $set_max_concurrent_http_conn_per_ip ; then
       $ip6t -A INPUT -p tcp -m multiport --dports 80,443 --syn \
       -m connlimit --connlimit-above $max_concurrent_http_conn_per_ip --connlimit-mask 128 \
       -m limit --limit 10/second --limit-burst 20 \
-      -j $LOG_TARGET $tag_log_prefix "$log_prefix more then 50 concurrent connections."
+      -j $LOG_TARGET $tag_log_prefix "$log_prefix more then $max_concurrent_http_conn_per_ip concurrent connections per IP."
    fi
 
    # HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen
@@ -2264,7 +2268,7 @@ if $set_max_new_http_conn_per_second ; then
    if $log_rejected || $log_all ; then
       $ip6t -A INPUT -p tcp -m multiport --dports 80,443 \
       --syn \
-      -m limit --limit 10/second --limit-burst 20 \
+      -m limit --limit ${max_new_http_conn_per_second}/second --limit-burst $burst_max_new_http_conn_per_second \
       -j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow."
    fi
 

ipt-firewall-server

@@ -2247,70 +2247,119 @@ echo_done
 # ---
 
 echo ""
-echononl "\t\tA maximum of 30 new connections per second per IP"
+echononl "\t\tA maximum number new connections per second per IP"
 
-if $log_rejected || $log_all ; then
+if $set_max_new_http_conn_per_ip_per_second ; then
+
+   if [[ -z "$max_http_new_conn_per_ip_per_second" || ! "$max_http_new_conn_per_ip_per_second" =~ ^[0-9]+$ ]]; then
+
+      max_http_new_conn_per_ip_per_second=$default_max_http_new_conn_per_ip_per_second
+
+   fi
+
+   burst_http_new_conn_per_ip_per_second=$((max_http_new_conn_per_ip_per_second * 2))
+
+   if $log_rejected || $log_all ; then
+      $ipt -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
+      -m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
+      --hashlimit-above ${max_http_new_conn_per_ip_per_second}/second \
+      --hashlimit-burst $burst_http_new_conn_per_ip_per_second \
+      --hashlimit-htable-expire 600000 \
+      -m limit --limit 10/second --limit-burst 20 \
+      -j $LOG_TARGET $tag_log_prefix "$log_prefix more then $max_http_new_conn_per_ip_per_second new connections per second"
+   fi
+
+   # HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen
+   # Über 30 neue Verbindungen/s pro IP werden gedroppt
+   # Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000).
    $ipt -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
    -m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
-   --hashlimit-above 30/second --hashlimit-burst 60 \
+   --hashlimit-above ${max_http_new_conn_per_ip_per_second}/second \
-   --hashlimit-htable-expire 600000 \
+   --hashlimit-burst $burst_http_new_conn_per_ip_per_second  \
-   -m limit --limit 10/second --limit-burst 20 \
+   --hashlimit-htable-expire 600000 -j DROP
-   -j $LOG_TARGET $tag_log_prefix "$log_prefix more then 30 new connections"
+
+   echo_done
+
+else
+
+   echo_skipped
+
 fi
 
-# HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen
-# Über 30 neue Verbindungen/s pro IP werden gedroppt
-# Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000).
-$ipt -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \
-  -m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \
-  --hashlimit-above 30/second --hashlimit-burst 60 \
-  --hashlimit-htable-expire 600000 -j DROP
 
-echo_done
+echononl "\t\tA maximum number of concurrent TCP connections per IP"
 
+if $set_max_concurrent_http_conn_per_ip ; then
 
-echononl "\t\tA maximum of 50 concurrent TCP connections per IP"
+   if [[ -z "$max_concurrent_http_conn_per_ip" || ! "$max_concurrent_http_conn_per_ip" =~ ^[0-9]+$ ]]; then
 
-if $log_rejected || $log_all ; then
+      max_concurrent_http_conn_per_ip=$default_max_concurrent_http_conn_per_ip
+
+   fi
+
+   if $log_rejected || $log_all ; then
+      $ipt -A INPUT -p tcp -m multiport --dports 80,443 --syn \
+      -m connlimit --connlimit-above $max_concurrent_http_conn_per_ip --connlimit-mask 128 \
+      -m limit --limit 10/second --limit-burst 20 \
+      -j $LOG_TARGET $tag_log_prefix "$log_prefix more then $max_concurrent_http_conn_per_ip concurrent connections per IP."
+   fi
+
+   # HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen
+   # Mehr als 50 parallele TCP-Verbindungen pro IP ablehnen
+   #
+   # Limit gilt pro einzelner IPv4-Adresse (--connlimit-mask 128) (z.bsp.  2a01:599:108:40b0:e1a9:170b:ba18:fd58/128)
    $ipt -A INPUT -p tcp -m multiport --dports 80,443 --syn \
-   -m connlimit --connlimit-above 50 --connlimit-mask 128 \
+   -m connlimit --connlimit-above $max_concurrent_http_conn_per_ip --connlimit-mask 128 \
-   -m limit --limit 10/second --limit-burst 20 \
+   -j REJECT --reject-with tcp-reset
-   -j $LOG_TARGET $tag_log_prefix "$log_prefix more then 50 concurrent connections."
+
+   echo_done
+
+else
+
+   echo_skipped
+
 fi
 
-# HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen
-# Mehr als 50 parallele TCP-Verbindungen pro IP ablehnen
-#
-# Limit gilt pro einzelner IPv4-Adresse (--connlimit-mask 128) (z.bsp.  2a01:599:108:40b0:e1a9:170b:ba18:fd58/128)
-$ipt -A INPUT -p tcp -m multiport --dports 80,443 --syn \
-  -m connlimit --connlimit-above 50 --connlimit-mask 128 \
-  -j REJECT --reject-with tcp-reset
 
-echo_done
+echononl "\t\tA maximum number of new TCP handshakes per second."
 
+if $set_max_new_http_conn_per_second ; then
 
-echononl "\t\tA maximum of 200 new TCP handshakes per second."
+   if [[ -z "$max_new_http_conn_per_second" || ! "$max_new_http_conn_per_second" =~ ^[0-9]+$ ]]; then
 
-# SYN-Rate begrenzen
+      max_new_http_conn_per_second=$default_max_new_http_conn_per_second
-#
-# Kurzfristig auch bis zu 400 syn pakete erlaubt. --limit-burst 400 - Danach greift das Limit."
-$ipt -A INPUT -p tcp -m multiport --dports 80,443 \
-   --syn \
-   -m limit --limit 200/second --limit-burst 400 \
-   -j ACCEPT
 
-if $log_rejected || $log_all ; then
+   fi
+
+   burst_max_new_http_conn_per_second=$((2 * max_new_http_conn_per_second))
+
+   # SYN-Rate begrenzen
+   #
+   # Kurzfristig auch bis zu 400 syn pakete erlaubt. --limit-burst 400 - Danach greift das Limit."
    $ipt -A INPUT -p tcp -m multiport --dports 80,443 \
-   --syn \
+      --syn \
-   -m limit --limit 10/second --limit-burst 20 \
+      -m limit --limit ${max_new_http_conn_per_second}/second --limit-burst $burst_max_new_http_conn_per_second \
-   -j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow."
+      -j ACCEPT
+
+   if $log_rejected || $log_all ; then
+      $ipt -A INPUT -p tcp -m multiport --dports 80,443 \
+      --syn \
+      -m limit --limit ${max_new_http_conn_per_second}/second --limit-burst $burst_max_new_http_conn_per_second \
+      -j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow."
+   fi
+
+   $ipt -A INPUT -p tcp -m multiport --dports 80,443 \
+      --syn \
+      -j DROP
+
+   echo_done
+
+else
+
+   echo_skipped
+
 fi
 
-$ipt -A INPUT -p tcp -m multiport --dports 80,443 \
-   --syn \
-   -j DROP
-
-echo_done
 echo ""