I'm setting up a server that I want to protect from DoS attacks, by setting a limit using iptables:
iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT (default policy DROP) # of course
The thing is that my website will be used by many computers all behind the same router, doing NAT. Let's say they're 100 computers.
Does iptables detect these 100 computers as different clients, or it thinks they're all the same because NAT replaces the source address to the public address? (and changes the source port to a 'random' one)?
If it considers them as a single client, then I'd have to raise the 25/minute to 2500/minute...