firewall/ipt-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Limit of new TCP connections per source IP: configurable rate, drop only above the limit.

Browse Source 
- default_settings.conf: new default_limit_new_tcp_connections_per_seconds_rate=30.
- main_ipv{4,6}.conf.sample: new limit_new_tcp_connections_per_seconds_rate
  (burst is twice the rate; invalid or empty values fall back to the default).
- ipt-firewall-server, ip6t-firewall-server: the rule no longer ACCEPTs SYNs
  below the limit (which bypassed the service rules, destination IPs and the
  HTTP limits); like the HTTP limits it now only logs and drops SYNs above
  the limit (--hashlimit-above). Fallback without xt_hashlimit: chain
  syn-multi-limit with a global limit.
- ip6t-firewall-server: fix --hashlimit-srcmask (128 instead of 32), drop
  only the given ports instead of all new TCP connections, hashlimit names
  syn_multi_v6*, add the can_use_hashlimit check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
chris
2026-11-11 18:50:58 +01:00
co-authored by Claude Opus 5.5
parent 93d9af854b
commit affa35def4
5 changed files with 106 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/main_ipv4.conf.sample
+7
View File
@@ -820,6 +820,13 @@ limit_new_tcp_connections_per_seconds_per_source_IP=true
#
limit_new_tcp_connections_per_seconds_ports=""
# - limit_new_tcp_connections_per_seconds_rate
# -
# - New (syn) TCP connections per second per source IP; the burst is twice
# - this value. Defaults to '$default_limit_new_tcp_connections_per_seconds_rate'.
# -
limit_new_tcp_connections_per_seconds_rate=${default_limit_new_tcp_connections_per_seconds_rate}
# -------------
# --- Router ?