Hi,
I try to limit the connection per ip with connlimit in addition to the
socket match, with the following rule:
$IPTABLES -t mangle -A PREROUTING -s $LAN -p tcp --syn --dport http -m
socket -m connlimit --connlimit-above 0 -j DIVERT
But as you can see, theses rules never match:
0 0 DIVERT tcp -- * * 192.168.100.0/24
0.0.0.0/0 tcp dpt:80flags: 0x17/0x02 socket #conn src/32 > 1
9 3030 DIVERT tcp -- * * 192.168.100.0/24
0.0.0.0/0 tcp dpt:80 socket
5 216 TPROXY tcp -- * * 192.168.100.0/24
0.0.0.0/0 tcp dpt:80 TPROXY redirect 0.0.0.0:50080 mark 0x1/0x1
0 0 DIVERT tcp -- * * 192.168.100.0/24
0.0.0.0/0 tcp dpt:3128flags: 0x17/0x02 socket #conn src/32 > 1
6 2491 DIVERT tcp -- * * 192.168.100.0/24
0.0.0.0/0 tcp dpt:3128 socket
19 800 TPROXY tcp -- * * 192.168.100.0/24
0.0.0.0/0 tcp dpt:3128 TPROXY redirect 0.0.0.0:50080 mark 0x1/0x1
Is this an expected behaviour, or a problem in my rules?
Regards
--
Jean-Philippe Menil - Pôle réseau Service IRTS
DSI Université de Nantes
jean-philippe.menil@xxxxxxxxxxxxxx
Tel : 02.53.48.49.27 - Fax : 02.53.48.49.09
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
