1 Allows you to restrict the number of parallel TCP connections to a
2 server per client IP address (or address block).
4 [\fB!\fR] \fB--connlimit-above \fIn\fR
5 match if the number of existing tcp connections is (not) above n
7 .BI "--connlimit-mask " "bits"
12 # allow 2 telnet connections per client host
13 iptables -p tcp --syn --dport 23 -m connlimit --connlimit-above 2 -j REJECT
15 # you can also match the other way around:
16 iptables -p tcp --syn --dport 23 -m connlimit ! --connlimit-above 2 -j ACCEPT
18 # limit the nr of parallel http requests to 16 per class C sized \
19 network (24 bit netmask)
20 iptables -p tcp --syn --dport 80 -m connlimit --connlimit-above 16
21 --connlimit-mask 24 -j REJECT