On Thursday 13 of October 2011, abirvalg@xxxxxxxxxxx wrote:
> Hi, it seems to me that limit module has issues with timer precision.
> The only iptables rules i have are:
>
> iptables -I OUTPUT 1 -m state --state NEW -m limit --limit 2000/sec
> --limit-burst 1 -j NFQUEUE --queue-num 11220 iptables -I OUTPUT 2
> -m state --state NEW -j NFQUEUE --queue-num 11222
>
> iptables -I INPUT 1 -m state --state NEW -m limit --limit 2000/sec
> --limit-burst 1 -j NFQUEUE --queue-num 11221 iptables -I INPUT 2 -m
> state --state NEW -j NFQUEUE --queue-num 11222
>
> (Both NFQUEUE 11220 and 11221 pass only NF_ACCEPT or NF_DROP
> verdicts.)
>
> If I understand -m limit correctly, only if there is more than 2000
> NEW connections going in or out, NFQUEUE 11222 will trigger.
Not exactly. With "--limit-burst 1", no more than one packet per jiffy
can pass the test. You may have only 30 NEW packets per second but it
doesn't mean one packet every 1/30 s. And if there are two (or more) NEW
packets within one jiffy, only the first passes the first rule.
Increasing the value of --limit-burst should help.
Michal Kubeček
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
