Setting for Iptables

[collisionystm]

iptables -A FORWARD -p tcp --syn --dport 80 -m connlimit --connlimit-above 12 -j REJECT --reject-with tcp-reset

I was reading this

http://www.cyberciti.biz/faq/iptable...-limits-howto/

Hope it works

nevermind. its a clone of your OP.

sorry about that

[sil3nthunt3r]

nevermind. its a clone of your OP.

sorry about that

Haha..if only that command works for me.

iptables -A INPUT -p tcp --dport 80 -i eth0 -m limit --limit 1/minute --limit-burst 9 -j ACCEPT

For above command, basically it works, but user will have difficulties to browse the same site using http, where the site will not load.

[collisionystm]

I guess that's the problem with Downloads and HTTP traffic going through the same port

[collisionystm]

maybe just limit how much bandwidth a user can have at any given time?

[sil3nthunt3r]

maybe just limit how much bandwidth a user can have at any given time?

Bandwidth is not a problem since the VPS is unmetered.
Right now, I've increased the MaxKeepAliveRequests from httpd.conf from 100 to 300 and implement the command below:

iptables -A INPUT -p tcp --dport 80 -i eth0 -m limit --limit 1/minute --limit-burst 9 -j ACCEPT

[sil3nthunt3r]

Some update:

iptables -p tcp --syn --dport 80 -m connlimit --connlimit-above 16 --connlimit-mask 24 -j REJECT

Why when I put above command, it give me error as below:

iptables: No chain/target/match by that name.

Ubuntu Server 10.04

[Doug S]

Some update:

iptables -p tcp --syn --dport 80 -m connlimit --connlimit-above 16 --connlimit-mask 24 -j REJECT

Why when I put above command, it give me error as below:

iptables: No chain/target/match by that name.

Ubuntu Server 10.04

I do not get the same error with your exact code as above. Anyway, you didn't specify a chain. I don't know if you wanted the INPUT chain or elsewhere, but this worked for me (meaning executed without error):

 
sudo iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 16 --connlimit-mask 24 -j REJECT

[sil3nthunt3r]

I do not get the same error with your exact code as above. Anyway, you didn't specify a chain. I don't know if you wanted the INPUT chain or elsewhere, but this worked for me (meaning executed without error):

 
sudo iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 16 --connlimit-mask 24 -j REJECT

Still got same error with the code you given above.

Is there any issue with my Ubuntu because the VPS is installed with Ubuntu 10.04, without iptables installed by default. Have to manually installed it.