On Friday 2011-09-09 10:55, Pandu Poluan wrote: >2011/9/9 Jean-Philippe Menil <jean-philippe.menil@xxxxxxxxxxxxxx>: >> Hi, >> >> I try to limit the connection per ip with connlimit in addition to the >> socket match, with the following rule: >> $IPTABLES -t mangle -A PREROUTING -s $LAN -p tcp --syn --dport http -m >> socket -m connlimit --connlimit-above 0 -j DIVERT >> >> But as you can see, theses rules never match: >> >> 0 0 DIVERT tcp -- * * 192.168.100.0/24 0.0.0.0/0 >> tcp dpt:80flags: 0x17/0x02 socket #conn src/32 > 1 >> 9 3030 DIVERT tcp -- * * 192.168.100.0/24 0.0.0.0/0 >> tcp dpt:80 socket >> 5 216 TPROXY tcp -- * * 192.168.100.0/24 0.0.0.0/0 >> tcp dpt:80 TPROXY redirect 0.0.0.0:50080 mark 0x1/0x1 >> 0 0 DIVERT tcp -- * * 192.168.100.0/24 0.0.0.0/0 >> tcp dpt:3128flags: 0x17/0x02 socket #conn src/32 > 1 >> 6 2491 DIVERT tcp -- * * 192.168.100.0/24 0.0.0.0/0 >> tcp dpt:3128 socket >> 19 800 TPROXY tcp -- * * 192.168.100.0/24 0.0.0.0/0 >> tcp dpt:3128 TPROXY redirect 0.0.0.0:50080 mark 0x1/0x1 >> >> Is this an expected behaviour, or a problem in my rules? >> > >I think it's because the PREROUTING table has no concept of connection >(conntrack has not started yet), so the number of connection(s) stays >at zero. > >Of course, I might be wrong. Someone please CMIIW. Indeed your assessment is false. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
