2

Since last week I have been seeing something fishy and it seems to be worsening. I tried many firewalls and they seem to be useless. I blocked all unwanted ports and only few ports are open so I found that my VPS get frozen when Packets per second get's over 20k. I want to know if there is some way to limit pps on opened ports and reject all other connections to the port until the pps get lowered to 10k.

Maybe this has been discussed, or will be available in Google, but I am unable to find (if this type exits) and only I found is this:

iptables -I INPUT -p tcp --dport 1234 -m hashlimit --hashlimit-mode srcip,srcport --hashlimit-name HASHNAME --hashlimit-htable-max 5000 --hashlimit-htable-expire 10000 --hashlimit-above 5/sec -j DROP

But I don't know what this rule means.

  • 2
    You should be figuring out if all of this traffic is legitimate first. If it is, and you start setting rules that will limit rates by dropping packets, you are going to be dropping legitimate packets just because you don't understand what's going on. Furthermore, if you did set up a rate limit, unless you can differentiate your administrative traffic from the rest, your actions will be at the mercy of your pps filter just the same. But, if this does not deter you... lmgtfy.com/?q=iptables+limit+packets – cremefraiche Dec 16 '14 at 22:31
  • 1
    @cremefraiche Afaik he wants to disable the new connections, without harming the already existing. I think it is quite possible he wants it so. – peterh Dec 17 '14 at 18:28
  • 1
    @PeterHorvath That is definitely not what I get out of the question. "I want to know if there is some way to limit pps on opened ports and reject all other connections...". The only way to limit pps on an open port that I know of is firewall rules. This means dropping packets, and probably packets he wants. – cremefraiche Dec 17 '14 at 22:24
2

You can limit connections by network blocks, e.g. choose a size such as a C class (256 IPs) and then limit each C class connecting to you to say 10 connection per block of IPs. Unless an attacker is on the same C class as you (unlikely) then you will be able to connect still. To do this use the "--connlimit-mask" option, explained in:

http://ipset.netfilter.org/iptables-extensions.man.html

An example to limit access to your SSH server port would be:

iptables -p tcp --syn --dport 22 \
-m connlimit \ 
--connlimit-above 10 \
--connlimit-mask 24 \
-j REJECT

So first we specify the protocol TCP, then SYN packets (connection initiation) and a destination port of 22. Then we use the connection limit module, limit it to 10 connections for each network block with a network mask of /24 (a C class with 256 IPs).

  • Classful networking on the Internet was deprecated in 1993 by the introduction of classless interdomain routing (CIDR). – a CVn Oct 26 '15 at 21:25
  • 1
    In this context that doesn't really have anything to do with... anything. He simply wants to limit a DoS, limiting connections per C class (or /28 or /16 or whatever he decides is appropriate) is what he is looking for =). – Kurt Oct 26 '15 at 23:27
2

I am somewhat suspicious of your diagnosis of the cause of freezes, however if this is the case, then the question is off topic here and my first choice for a remedial action would be to look for a different hosting service(or asking the people who provide the current service to resolve the problem).

Yes, Linux has limited rate management facilities within iptables, and also has very sophisticated QOS based traffic management (you can't really connect the two) facilities but these have no effect on the rate at which packets arrive at your host, only the rate they leave at.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.