1 Allows you to restrict the number of parallel connections to a server per 2 client IP address (or client address block). 3 .TP 4 \fB\-\-connlimit\-upto\fP \fIn\fP 5 Match if the number of existing connections is below or equal \fIn\fP. 6 .TP 7 \fB\-\-connlimit\-above\fP \fIn\fP 8 Match if the number of existing connections is above \fIn\fP. 9 .TP 10 \fB\-\-connlimit\-mask\fP \fIprefix_length\fP 11 Group hosts using the prefix length. For IPv4, this must be a number between 12 (including) 0 and 32. For IPv6, between 0 and 128. If not specified, the 13 maximum prefix length for the applicable protocol is used. 14 .TP 15 \fB\-\-connlimit\-saddr\fP 16 Apply the limit onto the source group. This is the default if 17 \-\-connlimit\-daddr is not specified. 18 .TP 19 \fB\-\-connlimit\-daddr\fP 20 Apply the limit onto the destination group. 21 .PP 22 Examples: 23 .TP 24 # allow 2 telnet connections per client host 25 iptables \-A INPUT \-p tcp \-\-syn \-\-dport 23 \-m connlimit \-\-connlimit\-above 2 \-j REJECT 26 .TP 27 # you can also match the other way around: 28 iptables \-A INPUT \-p tcp \-\-syn \-\-dport 23 \-m connlimit \-\-connlimit\-upto 2 \-j ACCEPT 29 .TP 30 # limit the number of parallel HTTP requests to 16 per class C sized \ 31 source network (24 bit netmask) 32 iptables \-p tcp \-\-syn \-\-dport 80 \-m connlimit \-\-connlimit\-above 16 33 \-\-connlimit\-mask 24 \-j REJECT 34 .TP 35 # limit the number of parallel HTTP requests to 16 for the link local network 36 (ipv6) 37 ip6tables \-p tcp \-\-syn \-\-dport 80 \-s fe80::/64 \-m connlimit \-\-connlimit\-above 38 16 \-\-connlimit\-mask 64 \-j REJECT 39 .TP 40 # Limit the number of connections to a particular host: 41 ip6tables \-p tcp \-\-syn \-\-dport 49152:65535 \-d 2001:db8::1 \-m connlimit 42 \-\-connlimit-above 100 \-j REJECT 43
