2011/9/9 Jean-Philippe Menil <jean-philippe.menil@xxxxxxxxxxxxxx>: > Hi, > > I try to limit the connection per ip with connlimit in addition to the > socket match, with the following rule: > $IPTABLES -t mangle -A PREROUTING -s $LAN -p tcp --syn --dport http -m > socket -m connlimit --connlimit-above 0 -j DIVERT > > But as you can see, theses rules never match: > > 0 0 DIVERT tcp -- * * 192.168.100.0/24 0.0.0.0/0 > tcp dpt:80flags: 0x17/0x02 socket #conn src/32 > 1 > 9 3030 DIVERT tcp -- * * 192.168.100.0/24 0.0.0.0/0 > tcp dpt:80 socket > 5 216 TPROXY tcp -- * * 192.168.100.0/24 0.0.0.0/0 > tcp dpt:80 TPROXY redirect 0.0.0.0:50080 mark 0x1/0x1 > 0 0 DIVERT tcp -- * * 192.168.100.0/24 0.0.0.0/0 > tcp dpt:3128flags: 0x17/0x02 socket #conn src/32 > 1 > 6 2491 DIVERT tcp -- * * 192.168.100.0/24 0.0.0.0/0 > tcp dpt:3128 socket > 19 800 TPROXY tcp -- * * 192.168.100.0/24 0.0.0.0/0 > tcp dpt:3128 TPROXY redirect 0.0.0.0:50080 mark 0x1/0x1 > > Is this an expected behaviour, or a problem in my rules? > I think it's because the PREROUTING table has no concept of connection (conntrack has not started yet), so the number of connection(s) stays at zero. Of course, I might be wrong. Someone please CMIIW. Rgds, -- FdS Pandu E Poluan ~ IT Optimizer ~ • LOPSA Member #15248 • Blog : http://pepoluan.tumblr.com • Linked-In : http://id.linkedin.com/in/pepoluan -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
