connlimit netfilter patch



Related docs

Allows you to restrict the number of parallel TCP connections to a server per client IP address (or address block).

[!] --connlimit-above n

match if the number of existing tcp connections is (not) above n

--connlimit-mask bits

group hosts using mask


# allow 2 telnet connections per client host

iptables -A INPUT -p tcp --syn --dport 23 -m connlimit --connlimit-above 2 -j REJECT

# you can also match the other way around:

iptables -A INPUT -p tcp --syn --dport 23 -m connlimit ! --connlimit-above 2 -j ACCEPT

# limit the nr of parallel http requests to 16 per class C sized network (24 bit netmask)

iptables -p tcp --syn --dport 80 -m connlimit --connlimit-above 16 --connlimit-mask 24 -j REJECT