-P DROP
--state RELATED,ESTABLISHED -j ACCEPT --connlimit-above n -j LOG --state NEW --syn ! --connlimit-above n -j ACCEPT --state NEW --syn ... -j ACCEPT ... many ... -j ACCEPT
... many ... -j LOG to log packages which aren't accepted
and now it is working.
But, with this solution every SYN packet first has to be checked against the connlimit rule before entering the ACCEPT block. I would prefer to do the logging of unwanted packages after all accepting rules and this works fine with all the other matching modules (e.g. time, owner).
And, I am still worried about the fact, that a package no longer matches against a connlimit rule after it was checked against a !connlimit rule ...
Stephane Bortzmeyer wrote:
On Tue, May 18, 2004 at 09:00:52AM +0200,
Bernd Strebel <b.strebel@xxxxxxxxxx> wrote a message of 63 lines which said:
Along with the implementation of a simple rule set ( ACCEPT connections if ! --connlimit-above n and LOG connections if --connlimit-above n) we experienced a strange behavior of the connlimit matching module:
Rule #m: ...-m connlimit --connlimit-above n -j LOG Rule #m+1: ...-m connlimit ! --connlimit-above n -j ACCEPT
works fine, while
Rule #m: ...-m connlimit ! --connlimit-above n -j ACCEPT Rule #m+1: ...-m connlimit --connlimit-above n -j LOG
works not (no match on rule #m+1).
No idea but what I do (and it works) is:
Rule #m: ...-m connlimit --connlimit-above n -j LOG Rule #m+1: ...-m connlimit --connlimit-above n -j REJECT ... Other rules, which may accept
