Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm setting up a server that I want to protect from DoS attacks, by setting a limit using iptables:

iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT
(default policy DROP) # of course

The thing is that my website will be used by many computers all behind the same router, doing NAT. Let's say they're 100 computers.

Does iptables detect these 100 computers as different clients, or it thinks they're all the same because NAT replaces the source address to the public address? (and changes the source port to a 'random' one)?

If it considers them as a single client, then I'd have to raise the 25/minute to 2500/minute...

share|improve this question

1 Answer 1

up vote 2 down vote accepted

You are matching the packets by this lines, meaning you allow only 25 packets/minute.

You need to match number of sessions instead, then you won't care about the number of clients using same ip address, because you will be counting the new sessions only, i.e. SYN TCP Packets.

If there are 100 clients using same IP, they still need to open 100 new sessions, so if you accept only the first 25 new sessions, the remaining 75 sessions will be dropped.

You can use --limit to avoid various denial of service attacks (DoS) with a faster rate to increase responsiveness.

Syn-flood protection:

# iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT

Furtive port scanner:

# iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

Ping of death:

# iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

For more details, cceck http://www.netfilter.org/documentation/HOWTO//packet-filtering-HOWTO-7.html.

share|improve this answer
    
Excellent, thank you very much. And to match the number of sessions, i'd have to add "--state NEW" in the "--limit" rule, and then another allowing packets in "--state ESTABLISHED", right? Although for http as each request is a new connection it really doesn't matter too much... –  Victor Oliva Jan 10 at 7:16
    
The number of new sessions = the number of SYNs receieved by your host, each new session begins with a SYN packet. So you need only the --syn match shown above, try this first. –  aseaudi Jan 10 at 12:39
    
Ok, ty for clarifying! –  Victor Oliva Jan 10 at 14:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.