- default_settings.conf: new default_limit_new_tcp_connections_per_seconds_rate=30.
- main_ipv{4,6}.conf.sample: new limit_new_tcp_connections_per_seconds_rate
(burst is twice the rate; invalid or empty values fall back to the default).
- ipt-firewall-server, ip6t-firewall-server: the rule no longer ACCEPTs SYNs
below the limit (which bypassed the service rules, destination IPs and the
HTTP limits); like the HTTP limits it now only logs and drops SYNs above
the limit (--hashlimit-above). Fallback without xt_hashlimit: chain
syn-multi-limit with a global limit.
- ip6t-firewall-server: fix --hashlimit-srcmask (128 instead of 32), drop
only the given ports instead of all new TCP connections, hashlimit names
syn_multi_v6*, add the can_use_hashlimit check.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
chrisandClaude Opus 5.5