path: root/extensions/
diff options
authorJonas Berlin <>2005-04-01 06:54:23 +0000
committerHarald Welte <>2005-04-01 06:54:23 +0000
commitf33c46140f0e0a230aba5d739ce40cb14e066b13 (patch)
treee0d8b16f1fe5c33ce1bc2a0e2ab9a68f2e54f96c /extensions/
parent4a06cf0bd2f5e18eb0149945724b0b4299eec5ea (diff)
add lots of man pages (Jonas Berlin)
Diffstat (limited to 'extensions/')
1 files changed, 21 insertions, 0 deletions
diff --git a/extensions/ b/extensions/
new file mode 100644
index 00000000..404ee327
--- /dev/null
+++ b/extensions/
@@ -0,0 +1,21 @@
+Allows you to restrict the number of parallel TCP connections to a
+server per client IP address (or address block).
+[\fB!\fR] \fB--connlimit-above \fIn\fR
+match if the number of existing tcp connections is (not) above n
+.BI "--connlimit-mask " "bits"
+group hosts using mask
+# allow 2 telnet connections per client host
+iptables -p tcp --syn --dport 23 -m connlimit --connlimit-above 2 -j REJECT
+# you can also match the other way around:
+iptables -p tcp --syn --dport 23 -m connlimit ! --connlimit-above 2 -j ACCEPT
+# limit the nr of parallel http requests to 16 per class C sized \
+network (24 bit netmask)
+iptables -p tcp --syn --dport 80 -m connlimit --connlimit-above 16
+--connlimit-mask 24 -j REJECT