From 6f5d18486aeaabc05d0aaa57708dbf18cc72af5b Mon Sep 17 00:00:00 2001 From: "/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org" Date: Fri, 1 Apr 2005 06:54:23 +0000 Subject: add lots of man pages (Jonas Berlin) --- extensions/libipt_connlimit.man | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 extensions/libipt_connlimit.man (limited to 'extensions/libipt_connlimit.man') diff --git a/extensions/libipt_connlimit.man b/extensions/libipt_connlimit.man new file mode 100644 index 0000000..404ee32 --- /dev/null +++ b/extensions/libipt_connlimit.man @@ -0,0 +1,21 @@ +Allows you to restrict the number of parallel TCP connections to a +server per client IP address (or address block). +.TP +[\fB!\fR] \fB--connlimit-above \fIn\fR +match if the number of existing tcp connections is (not) above n +.TP +.BI "--connlimit-mask " "bits" +group hosts using mask +.P +Examples: +.TP +# allow 2 telnet connections per client host +iptables -p tcp --syn --dport 23 -m connlimit --connlimit-above 2 -j REJECT +.TP +# you can also match the other way around: +iptables -p tcp --syn --dport 23 -m connlimit ! --connlimit-above 2 -j ACCEPT +.TP +# limit the nr of parallel http requests to 16 per class C sized \ +network (24 bit netmask) +iptables -p tcp --syn --dport 80 -m connlimit --connlimit-above 16 +--connlimit-mask 24 -j REJECT -- cgit v1.2.3