top button
Flag Notify
Site Registration

Netfilter: How to limit the number of connection of a "certain type"?

+1 vote
323 views

I would like to configure the Netfilter to limit the number of connections of a "certain type". The connlimit match does not seem to meet my needs. From the man page,

"... Allows you to restrict the number of parallel connections to a server per client IP address (or client address block). ..."

the connlimit match counts the connection to a server (a single destination IP, I suppose) from an IP address (client IP) or client address block.

I would rather count (and limit) the number of connections based on my own classification. For example, I would like to limit the number of connection from IPs in a given subnet and directed to IPs in another
given subnet.

I guess I can reach the goal using the quota2 match, which give me the ability to increase and decrease a counter: essentially I'll increase the counter with a SYN packet and decrease the counter with a FIN packet. But this solution is incomplete: it can not count the connections not closed with a FIN packet (time outed connections) and It can't manage the UDP connections (already properly managed by the conntrack module).

posted Oct 3, 2013 by Deepak Dasgupta

Looking for an answer?  Promote on:
Facebook Share Button Twitter Share Button LinkedIn Share Button

Similar Questions
+1 vote

Is there a way to find out if there any iptables rules set on a machine ?

There are some indirect ways which will not always work; for example, I know that on most hosts, iptables -S will return the following output (when no iptable rules are set)
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT

So you can check whether or not the number of output lines is greater than 3 (as an indication of whether or not iptables rules are set). But there are hosts on which there are more chains then these 3; these chains are set by application/services, even without any iptable rules which are set. And after running iptables -F on these machines, iptables -S will still show more than 3 chains, even that there are no iptables rules set in these chains.

So the question is - is there a way to know whether or not netfilter rules are set on a host, regardless of the number of chains ?

0 votes

Is it possible to bind multiple address families in netfilter queue? I see IPv4 show up in my queue, but not ARP. With error code removed, here is how I'm calling nfq_bind:

netfilterqueue_handle = nfq_open();
netfilterqueue_queue = nfq_create_queue( netfilterqueue_handle, 0,

nfq_bind_pf( netfilterqueue_handle, AF_INET );
nfq_bind_pf( netfilterqueue_handle, NF_ARP );

I'm thinking the more likely possibility is the iptable rules I'm using to send traffic to the queue are too restrictive. Here are the rules I have:

# Generated by iptables-save v1.4.21 on Sat Feb 14 10:40:46 2015
*nat
:PREROUTING ACCEPT [161:14105]
:INPUT ACCEPT [56:4995]
:OUTPUT ACCEPT [56:4496]
:POSTROUTING ACCEPT [56:4496]
-A POSTROUTING -s 10.0.1.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Sat Feb 14 10:40:46 2015
# Generated by iptables-save v1.4.21 on Sat Feb 14 10:40:46 2015
*filter
:INPUT ACCEPT [1017:217421]
:FORWARD DROP [53:2307]
:OUTPUT ACCEPT [934:211104]
:MYRA - [0:0]
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j MYRA
-A FORWARD -s 10.0.1.0/24 -o eth0 -m conntrack --ctstate NEW -j MYRA
-A MYRA -j NFQUEUE --queue-num 0 --queue-bypass
COMMIT
# Completed on Sat Feb 14 10:40:46 2015

Do I have to add another FORWARD line to get ARP to jump to MYRA? What would it look like?

+1 vote

I know that packet traverses through the Net Filter hooks but how to practically realize that, any suggestions...

+1 vote

How do i set tcp flags ? I tried

 nft add rule filter output tcp flags {syn,rst} counter

but failed ... also can some point me to valid syntaxes ..

+1 vote

How do I add a multiport rule

 nft add rule ip filter output tcp dports 99,200 ip daddr 1.1.1.1
 counter meta oif eth0 fails.

I see that the range works,

 nft add rule ip filter output tcp dport 99-105 ip daddr 1.1.1.1
 counter meta oif eth0
...