Le 09/09/2011 11:12, Jozsef Kadlecsik a écrit :
On Fri, 9 Sep 2011, Jean-Philippe Menil wrote:
I try to limit the connection per ip with connlimit in addition to the socket
match, with the following rule:
$IPTABLES -t mangle -A PREROUTING -s $LAN -p tcp --syn --dport http -m socket
-m connlimit --connlimit-above 0 -j DIVERT
But as you can see, theses rules never match:
0 0 DIVERT tcp -- * * 192.168.100.0/24 0.0.0.0/0
tcp dpt:80flags: 0x17/0x02 socket #conn src/32> 1
9 3030 DIVERT tcp -- * * 192.168.100.0/24 0.0.0.0/0
tcp dpt:80 socket
5 216 TPROXY tcp -- * * 192.168.100.0/24 0.0.0.0/0
tcp dpt:80 TPROXY redirect 0.0.0.0:50080 mark 0x1/0x1
0 0 DIVERT tcp -- * * 192.168.100.0/24 0.0.0.0/0
tcp dpt:3128flags: 0x17/0x02 socket #conn src/32> 1
6 2491 DIVERT tcp -- * * 192.168.100.0/24 0.0.0.0/0
tcp dpt:3128 socket
19 800 TPROXY tcp -- * * 192.168.100.0/24 0.0.0.0/0
tcp dpt:3128 TPROXY redirect 0.0.0.0:50080 mark 0x1/0x1
Is this an expected behaviour, or a problem in my rules?
You use the socket match from the PREROUTING chain, where it'll never
match: it's before routing, so the the system could not associate the
packet to a socket yet.
Best regards,
Jozsef
Ok, i see.
So, if my understand is correct, it will be better to do like this:
$IPTABLES -t mangle -A PREROUTING -s $LAN -p tcp --dport http -m socket
-j DIVERT
$IPTABLES -t mangle -A PREROUTING -s $LAN -p tcp --dport http -j TPROXY
--tproxy-mark 0x1/0x1 --on-port 50080
$IPTABLES -t mangle -N DIVERT
$IPTABLES -t mangle -A DIVERT -j MARK --set-mark 1
$IPTABLES -t mangle -A DIVERT -m connlimit --connlimit-above 2 -j LOG
--log-prefix "CONNLIMIT "
$IPTABLES -t mangle -A DIVERT -m connlimit ! --connlimit-above 2 -j ACCEPT
Regards.
--
Jean-Philippe Menil - Pôle réseau Service IRTS
DSI Université de Nantes
jean-philippe.menil@xxxxxxxxxxxxxx
Tel : 02.53.48.49.27 - Fax : 02.53.48.49.09
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
