I am trying to limit the number of tcp connections each IP can keep ESTABLISHED at any given time. Checking ip_conntrack file, I notice that connlimit is not working. All connlimit rules are before NAT rules. What I am doing wrong? Any help will be appreciated -Carlos modprobe iptable_nat modprobe ip_conntrack modprobe ip_conntrack_ftp modprobe ip_nat_ftp modprobe ipt_limit modprobe ipt_state iptables -t filter -P INPUT DROP iptables -t filter -P FORWARD DROP iptables -N CONNLIMIT iptables -A FORWARD -p TCP -d 0/0 --dport 1024:1862 -j CONNLIMIT iptables -A FORWARD -p TCP -d 0/0 --dport 1864:3127 -j CONNLIMIT iptables -A FORWARD -p TCP -d 0/0 --dport 3129:5599 -j CONNLIMIT iptables -A FORWARD -p TCP -d 0/0 --dport 5601:5899 -j CONNLIMIT iptables -A FORWARD -p TCP -d 0/0 --dport 5901:7776 -j CONNLIMIT iptables -A FORWARD -p TCP -d 0/0 --dport 7778:65535 -j CONNLIMIT iptables -A CONNLIMIT -p TCP -m state ! --state RELATED -m connlimit --connlimit-above 12 --connlimit-mask 32 -j DROP # iptables -L ... deleted ... CONNLIMIT tcp -- anywhere anywhere tcp dpts:1024:techra-server CONNLIMIT tcp -- anywhere anywhere tcp dpts:paradym-31port:ctx-bridge CONNLIMIT tcp -- anywhere anywhere tcp dpts:netport-id:esinstall CONNLIMIT tcp -- anywhere anywhere tcp dpts:esmagent:5899 CONNLIMIT tcp -- anywhere anywhere tcp dpts:5901:7776 CONNLIMIT tcp -- anywhere anywhere tcp dpts:interwise:65535 Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain CONNLIMIT (6 references) target prot opt source destination DROP tcp -- anywhere anywhere state INVALID,NEW,ESTABLISHED,UNTRACKED #conn/32 > 12 _____ avast! Antivirus <http://www.avast.com> : Outbound message clean. Virus Database (VPS): 000704-1, 22/01/2007 Tested on: 22/1/2007 15:11:59 avast! - copyright (c) 2000-2007 ALWIL Software.
