Limit the amount of concurrent connections from the same IP address using IP Tables | Infosecwithme Blog

Limit the amount of concurrent connections from the same IP address

Hello All, here I am posting the little trick in Linux to Limit the amount of concurrent connections from the same IP address.
        1. In Unix based OS,  we can use IP Tables functionality (aka Linux Firewall) to restrict the communication inbound or outbound.
        2. Many times it is observed that unnecessary traffic is flowing from Linux server within organization or outside. To fix these, it is easy to linux admin to restrict such a communication at linux end so only authorised communication will occur.

here we will refer this articles with respect to prevent DDoS attack at primarily level.

In order to do so, you need to apply the following rule: 

iptables -I INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set

iptables -I INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 -j DROP

iptables-save >/etc/iptables.up.rules

The first line will Watch the IP connecting to your eth0 interface. 
The second line will Check if the connection is new within the last 60 seconds and if the packet flow is higher than ten and if so it will drop the connection. 
The third line will Make the rules persistant in case of a reboot (at least in debian, you may need to specify another patch or file where the rules are stored for loading at boot time)

Advantage:
1. we can block the BOT communication using IP tables.
2. we can minimize the chances of DDoS attack at primary level.


Credit: 

https://github.com/Tatuy/Guia3d/wiki/How-to-limit-the-ammount-of-concurrent-connections-from-the-same-IP-address

Your Good comments Encourages me to keep posting Nice Articles so keep Commenting & Sharing