chrisandClaude Opus 5.5
93d9af854b
- HTTP(S) connection limits are only created if 'http_server_ips' is set.
The global SYN rate limit no longer ACCEPTs packets (which opened ports
80/443 on every host) - it now only drops packets above the limit
(hashlimit without '--hashlimit-mode'). Ports are opened exclusively by
the rules for 'http_server_ips'.
- Use '$http_ports' instead of hard coded '80,443' for the limits.
- ipt-firewall-server: use '--connlimit-mask 32' instead of 128. With the
nf_tables backend mask 128 ended up as mask 0, so the limit applied to
all clients together instead of per IP. Rename hashlimit 'http_v6' -> 'http_v4'.
- Log rules use their own hashlimit tables ('*_log'), otherwise each packet
is counted twice when logging is enabled.
- SYN-Overflow log rule now logs packets above (not below) the limit.
- ip6t-firewall-server: clamp TCP MSS for HTTPS on all external interfaces
instead of hard coded 'eth0'.
- Quote test for 'mm_tcp_ports_in' ('[ -n ${mm_tcp_ports_in} ]' was always true).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
# --- # - Install netfilter userspace logging daemon. # --- apt-get install ulogd2 # --- # - Adjust configuration file '/etc/ulogd.conf' # --- # - (1) # - # - Define two new plugin stacks inside '[global]'. # - # - directly after the last "plugin="/usr/lib.." statement add: # - # - # ==================================================================== # - # Define two new plugin stacks inside for iptables logging # - # ==================================================================== # - # - # - # - firewall11 - for IPv4 Firewall # - # - firewall12 - for IPv6 Firewall # - # - # - stack=firewall11:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,emu11:LOGEMU # - stack=firewall12:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,emu12:LOGEMU # - vim /etc/ulogd.conf # - (2) # - # - - Define input plugins using above specified netlink group # - - Define output plugins # - cat <<EOF >> /etc/ulogd.conf # ========================================================= # Define input plugins using specified netlink group inside # ========================================================= [firewall11] group=11 [firewall12] group=12 # ===================== # Define output plugins # ===================== [emu11] file="/var/log/ulog/iptables.log" sync=1 [emu12] file="/var/log/ulog/ip6tables.log" sync=1 EOF # - Restart ulog daemon # systemctl restart ulogd