diff options
| author | Jan Engelhardt <jengelh@medozas.de> | 2011-01-19 02:09:39 +0100 |
|---|---|---|
| committer | Jan Engelhardt <jengelh@medozas.de> | 2011-01-19 18:28:14 +0100 |
| commit | 5da9e63f66ca190cb90193ebb9eebf5aa523b4d1 (patch) | |
| tree | f91bce867a70b45a1b5c59c344f8d37ffd7cb93b /extensions/libxt_connlimit.man | |
| parent | 2cae5334de3a817947742e0b466355e5f5566474 (diff) | |
libxt_connlimit: support for dstaddr-supporting revision 1
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Diffstat (limited to 'extensions/libxt_connlimit.man')
| -rw-r--r-- | extensions/libxt_connlimit.man | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/extensions/libxt_connlimit.man b/extensions/libxt_connlimit.man index ecc80272..bd369a69 100644 --- a/extensions/libxt_connlimit.man +++ b/extensions/libxt_connlimit.man @@ -11,7 +11,13 @@ Match if the number of existing connections is above \fIn\fP. Group hosts using the prefix length. For IPv4, this must be a number between (including) 0 and 32. For IPv6, between 0 and 128. If not specified, the maximum prefix length for the applicable protocol is used. -.P +.TP +\fB\-\-connlimit\-saddr\fP +Apply the limit onto the source group. +.TP +\fB\-\-connlimit\-daddr\fP +Apply the limit onto the destination group. +.PP Examples: .TP # allow 2 telnet connections per client host @@ -21,7 +27,7 @@ iptables \-A INPUT \-p tcp \-\-syn \-\-dport 23 \-m connlimit \-\-connlimit\-abo iptables \-A INPUT \-p tcp \-\-syn \-\-dport 23 \-m connlimit \-\-connlimit\-upto 2 \-j ACCEPT .TP # limit the number of parallel HTTP requests to 16 per class C sized \ -network (24 bit netmask) +source network (24 bit netmask) iptables \-p tcp \-\-syn \-\-dport 80 \-m connlimit \-\-connlimit\-above 16 \-\-connlimit\-mask 24 \-j REJECT .TP @@ -29,3 +35,7 @@ iptables \-p tcp \-\-syn \-\-dport 80 \-m connlimit \-\-connlimit\-above 16 (ipv6) ip6tables \-p tcp \-\-syn \-\-dport 80 \-s fe80::/64 \-m connlimit \-\-connlimit\-above 16 \-\-connlimit\-mask 64 \-j REJECT +.TP +# Limit the number of connections to a particular host: +ip6tables \-p tcp \-\-syn \-\-dport 49152:65535 \-d 2001:db8::1 \-m connlimit +\-\-connlimit-above 100 \-j REJECT |