| View previous topic :: View next topic |
| Author |
Message |
pahud
Tux's lil' helper
Joined: 26 Nov 2002
Posts: 103
|
 Posted: Wed Feb 26, 2003 1:59 pm Post subject: allow only one incoming tcp connection from a source IP? |
 |
|
I have a daemon listening on tcp port 2235 and I'd like restrict that
every client can only has 1 active inbound tcp connection to this socket.
Is it possible to control the limit by iptables? I know there are limit and iplimit modules availabe but they don't fits my requirement. Any example or URL is highly welcome here.  |
|
| Back to top |
|
 |
pahud
Tux's lil' helper
Joined: 26 Nov 2002
Posts: 103
|
| Posted: Wed Feb 26, 2003 2:36 pm Post subject: |
|
|
Simply to say, something like
in xinetd
But I wish to deploy this with iptables.
idea? |
|
| Back to top |
|
|
rtn
Guru
Joined: 15 Nov 2002
Posts: 427
|
| Posted: Wed Feb 26, 2003 3:44 pm Post subject: |
|
|
Check out this iptables module in the kernel:
Connections/IP limit match support
--rtn |
|
| Back to top |
|
|
pahud
Tux's lil' helper
Joined: 26 Nov 2002
Posts: 103
|
| Posted: Thu Feb 27, 2003 12:24 am Post subject: |
|
|
| rtn wrote: | Check out this iptables module in the kernel:
Connections/IP limit match support
--rtn |
Well, you mean something list this?
| Code: | # iptables -I INPUT -p tcp --dport 6666 -m limit --limit
1/s -j allowed |
I am afraid the client can have more than 1 tcp connection to tcp:6666
in the first second or even have 1 connection every second, that is to say,
10 connectoins after 10 seconds.
Idea?  |
|
| Back to top |
|
|
pahud
Tux's lil' helper
Joined: 26 Nov 2002
Posts: 103
|
| Posted: Thu Feb 27, 2003 7:51 am Post subject: |
|
|
I think I found the solution
| Code: |
iptables -A INPUT -p tcp --dport 80 -s xxx.xxx.xxx.xxx -m iplimit
--iplimit-above 1 -j REJECT
iptables -A INPUT -p tcp --dport 80 -s xxx.xxx.xxx.xxx -j ACCEPT
iptables -P INPUT DROP
|
When the first connection comes, it will bypass the first rule and
match the 2nd rule. When the 2nd connection comes while the 1st is still
connected, it will match the 1st rule and hence rejected. |
|
| Back to top |
|
|
|
Networking & Security
