- default_settings.conf: new default_limit_new_tcp_connections_per_seconds_rate=30.
- main_ipv{4,6}.conf.sample: new limit_new_tcp_connections_per_seconds_rate
(burst is twice the rate; invalid or empty values fall back to the default).
- ipt-firewall-server, ip6t-firewall-server: the rule no longer ACCEPTs SYNs
below the limit (which bypassed the service rules, destination IPs and the
HTTP limits); like the HTTP limits it now only logs and drops SYNs above
the limit (--hashlimit-above). Fallback without xt_hashlimit: chain
syn-multi-limit with a global limit.
- ip6t-firewall-server: fix --hashlimit-srcmask (128 instead of 32), drop
only the given ports instead of all new TCP connections, hashlimit names
syn_multi_v6*, add the can_use_hashlimit check.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- HTTP(S) connection limits are only created if 'http_server_ips' is set.
The global SYN rate limit no longer ACCEPTs packets (which opened ports
80/443 on every host) - it now only drops packets above the limit
(hashlimit without '--hashlimit-mode'). Ports are opened exclusively by
the rules for 'http_server_ips'.
- Use '$http_ports' instead of hard coded '80,443' for the limits.
- ipt-firewall-server: use '--connlimit-mask 32' instead of 128. With the
nf_tables backend mask 128 ended up as mask 0, so the limit applied to
all clients together instead of per IP. Rename hashlimit 'http_v6' -> 'http_v4'.
- Log rules use their own hashlimit tables ('*_log'), otherwise each packet
is counted twice when logging is enabled.
- SYN-Overflow log rule now logs packets above (not below) the limit.
- ip6t-firewall-server: clamp TCP MSS for HTTPS on all external interfaces
instead of hard coded 'eth0'.
- Quote test for 'mm_tcp_ports_in' ('[ -n ${mm_tcp_ports_in} ]' was always true).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
chrisandClaude Opus 5.5
Christoph
ckubu