Why does the iptables connection limit not work? - iptables

Question

this is my iptables, everything works fine, except that these IP's with more than 20 connection wont get blocked.
iptables -F
iptables -X
iptables -I INPUT 1 -i lo -j ACCEPT
iptables -I INPUT 2 -i eth0 -p tcp --dport 6606 -m state --state NEW,RELATED,ESTABLISHED -m limit --limit 2/s --limit-burst 4 -j ACCEPT
iptables -I INPUT 3 -i eth0 -p tcp --dport 6624 -m state --state NEW,RELATED,ESTABLISHED -m limit --limit 2/s --limit-burst 4 -j ACCEPT
iptables -I INPUT 4 -i eth0 -p tcp --dport 6610 -m state --state NEW,RELATED,ESTABLISHED -m limit --limit 2/s --limit-burst 4 -j ACCEPT
iptables -I INPUT 5 -i eth0 -p tcp --dport 6610 -m state --state NEW,RELATED,ESTABLISHED -m limit --limit 2/s --limit-burst 4 -j ACCEPT
iptables -I INPUT 6 -i eth0 -p icmp --icmp-type echo-request -j ACCEPT
iptables -I INPUT 7 -i eth0 -p icmp --icmp-type echo-reply -j ACCEPT
iptables -I INPUT 8 -i eth0 -m connlimit --connlimit-above 20 -j DROP
iptables -I OUTPUT 1 -o lo -j ACCEPT
iptables -I OUTPUT 2 -o eth0 -p tcp --sport 6606 -m state --state NEW,RELATED,ESTABLISHED -m limit --limit 2/s --limit-burst 4 -j ACCEPT
iptables -I OUTPUT 3 -o eth0 -p tcp --sport 6624 -m state --state NEW,RELATED,ESTABLISHED -m limit --limit 2/s --limit-burst 4 -j ACCEPT
iptables -I OUTPUT 4 -o eth0 -p tcp --sport 6610 -m state --state NEW,RELATED,ESTABLISHED -m limit --limit 2/s --limit-burst 4 -j ACCEPT
iptables -I OUTPUT 5 -o eth0 -p tcp --sport 6610 -m state --state NEW,RELATED,ESTABLISHED -m limit --limit 2/s --limit-burst 4 -j ACCEPT
iptables -I OUTPUT 6 -o eth0 -p icmp --icmp-type echo-reply -j ACCEPT
iptables -I OUTPUT 7 -o eth0 -p icmp --icmp-type echo-request -j ACCEPT
iptables -I OUTPUT 8 -o eth0 -m connlimit --connlimit-above 20 -j DROP
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
What's wrong? Why does connection limit not work?

Answer 1

You're accepting connections without a connlimit specification before the connlimit DROP rule is set.
Try putting the DROP rule above all the others or specify a --connlimit-upto inside each one of your ACCEPT rules. e.g.
iptables -A INPUT -i eth0 -p tcp --dport 6606 \
-m state --state NEW,RELATED,ESTABLISHED \
-m connlimit --connlimit-upto 20 -m limit --limit 2/s --limit-burst 4 -j ACCEPT

Answer 2

Actually which connection you wanted to limit here. SSH or HTTP or HTTPS or TELNET.
In the below rule, just replace the port 80 with 22 for SSH and 23 for TELNET, so it should work.
iptables –I INPUT -p tcp --dport 80 -m state --state NEW -m
connlimit --connlimit-above 20 -j REJECT --reject-with
icmp-admin-prohibited
Also, in some of the recent kernel the connlimit module is removed, so either you have to patch up the module inside the kernel or use the hashlimit module for restricting the connections. Hashlimit module is more stronger and flexible that connlimit module.
The below rule will limit to the 20 connections per min for the corresponding destination ip.
iptables -A INPUT-p tcp --dport 80 -m state --state NEW -m hashlimit
--hashlimit-name \ HTTP_LIMIT –hashlimit 20/day--hashlimit-burst 1 --hashlimit-mode dstip -j ACCEPT
For more explanation, refer http://ipset.netfilter.org/iptables-extensions.man.html#lbAW.