Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[solved]"--match conntrack --ctstate NEW" versus "--syn"
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
toralf
Developer
Developer


Joined: 01 Feb 2004
Posts: 3562
Location: Hamburg

PostPosted: Fri Dec 15, 2017 4:33 pm    Post subject: [solved]"--match conntrack --ctstate NEW" versus & Reply with quote

I do wonder if there's a different behaviour of iptables wrt the commands above?

Last edited by toralf on Mon Dec 18, 2017 1:28 pm; edited 1 time in total
Back to top
View user's profile Send private message
Ant P.
Watchman
Watchman


Joined: 18 Apr 2009
Posts: 5074

PostPosted: Fri Dec 15, 2017 10:52 pm    Post subject: Reply with quote

--syn only works for TCP, conntrack works on any protocol.
Back to top
View user's profile Send private message
toralf
Developer
Developer


Joined: 01 Feb 2004
Posts: 3562
Location: Hamburg

PostPosted: Sun Dec 17, 2017 5:59 pm    Post subject: Reply with quote

Ant P. wrote:
--syn only works for TCP, conntrack works on any protocol.
ah - thx, so --syn is ok here.

BTW I do wonder why this rule
Code:
iptables -A OUTPUT -p tcp --destination-port 443 --syn --match connlimit --connlimit-above $max --connlimit-mask 0 --connlimit-daddr --match limit --limit 10/minute -j LOG --log-prefix "rule hit "
fires 2x within the same second :
Code:

Dec 17 18:54:13 mr-fox kernel: [ 7703.188832] rule hit IN= OUT=eth0 SRC=5.9.158.75 DST=52.214.218.140 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=23278 DF PROTO=TCP SPT=54074 DPT=443
Dec 17 18:54:13 mr-fox kernel: [ 7703.190016] rule hit IN= OUT=eth0 SRC=5.9.158.75 DST=52.214.218.140 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=45436 DF PROTO=TCP SPT=54076 DPT=443
- does this happen b/c the source port do differ ?
Back to top
View user's profile Send private message
Hu
Moderator
Moderator


Joined: 06 Mar 2007
Posts: 12490

PostPosted: Sun Dec 17, 2017 6:56 pm    Post subject: Reply with quote

There exists a quirk in the rate limiter related to burst activity. See man iptables-extension section limit for full details. In short, if you don't specify --limit-burst N, then N is assumed to be 5 (according to the man page here, at least), so it can burst log up to 5 messages before settling to the average that you specified of 10 per minute.
man iptables-extension:
       --limit rate[/second|/minute|/hour|/day]
              Maximum average matching rate: specified as a  number,  with  an
              optional  `/second',  `/minute',  `/hour', or `/day' suffix; the
              default is 3/hour.

       --limit-burst number
              Maximum initial number of packets to  match:  this  number  gets
              recharged  by  one  every  time the limit specified above is not
              reached, up to this number; the default is 5.
Back to top
View user's profile Send private message
toralf
Developer
Developer


Joined: 01 Feb 2004
Posts: 3562
Location: Hamburg

PostPosted: Sun Dec 17, 2017 7:26 pm    Post subject: Reply with quote

Hu wrote:
There exists a quirk in the rate limiter related to burst activity. See man iptables-extension section limit for full details. In short, if you don't specify --limit-burst N, then N is assumed to be 5 (according to the man page here, at least), so it can burst log up to 5 messages before settling to the average that you specified of 10 per minute.
indeed - thx !
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum