☰

ip 表限制每个 ip 地址的连接数可以被绕过吗？

tag-icon • tag-icon networking server iptables firewall
ip 表限制每个 ip 地址的连接数可以被绕过吗？

我目前使用以下方法来限制 IP 连接：

iptables -A INPUT -p tcp --syn --dport 22 -m connlimit --connlimit-above 4 --connlimit-mask 32 -j REJECT --reject-with tcp-reset

将每个 IP 的连接限制在端口 22，因此连接限制为 4，但有时我看到某些 IP 仍然可以连接 50 个。有什么建议可以解决这个问题？我的表格如下：

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
REJECT     tcp  --  anywhere             anywhere             tcp dpt:20000 flags:FIN,SYN,RST,ACK/SYN #conn src/32 > 2 reject-with tcp-reset
REJECT     tcp  --  anywhere             anywhere             tcp dpt:ssh flags:FIN,SYN,RST,ACK/SYN #conn src/32 > 2 reject-with tcp-reset

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination


netstat -ant | awk '{print $6}' | sort | uniq -c | sort -n
      1 CLOSE_WAIT
      1 established)
      1 Foreign
      6 FIN_WAIT2
     11 LISTEN
     12 TIME_WAIT
     58 FIN_WAIT1
     80 ESTABLISHED
     90 LAST_ACK
    135 SYN_RECV

添加 iptables

sudo iptables -v -x -n -L
Chain INPUT (policy ACCEPT 12000346 packets, 771042886 bytes)
    pkts      bytes target     prot opt in     out     source               destination  
       0        0 ACCEPT     tcp  --  lxcbr0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
       0        0 ACCEPT     udp  --  lxcbr0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
       0        0 ACCEPT     tcp  --  lxcbr0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:67
       0        0 ACCEPT     udp  --  lxcbr0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
       0        0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:20000 flags:0x17/0x02 #conn src/32 > 2 reject-with tcp-reset
  401401 20329584 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22 flags:0x17/0x02 #conn src/32 > 2 reject-with tcp-reset

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination  
       0        0 ACCEPT     all  --  *      lxcbr0  0.0.0.0/0            0.0.0.0/0      
       0        0 ACCEPT     all  --  lxcbr0 *       0.0.0.0/0            0.0.0.0/0      

Chain OUTPUT (policy ACCEPT 11508472 packets, 493814350 bytes)
    pkts      bytes target     prot opt in     out     source               destination

相关内容