iptables and connlimit

[NullDevice]

helloo friends,

i was just working with iptables and connlimit and facing a little bit of problem i hope u peep can help me out very well.

pls have a look on the command that i executed after fresh installation of iptables from rpm.

[root@MDK10 firewall]# iptables -I INPUT 1 -p tcp --syn --dport 80 -m connlimit ! --connlimit-above 2 -j ACCEPT
iptables: No chain/target/match by that name.

but have a look at this toooo

[root@MDK10 firewall]# iptables -I INPUT 1 -p tcp --syn --dport 80 -m connlimit -j ACCEPT
iptables v1.2.9: You must specify `--connlimit-above'

so connlimit is there and modules gets loaded ( i suppose, coz it shows me the error for incomplete parameters in the second command).

any ideas where i am slipping?

[NullDevice]

helloo friends,

i was just working with iptables and connlimit and facing a little bit of problem i hope u peep can help me out very well.

pls have a look on the command that i executed after fresh installation of iptables from rpm.

[root@MDK10 firewall]# iptables -I INPUT 1 -p tcp --syn --dport 80 -m connlimit ! --connlimit-above 2 -j ACCEPT
iptables: No chain/target/match by that name.

but have a look at this toooo

[root@MDK10 firewall]# iptables -I INPUT 1 -p tcp --syn --dport 80 -m connlimit -j ACCEPT
iptables v1.2.9: You must specify `--connlimit-above'

so connlimit is there and modules gets loaded ( i suppose, coz it shows me the error for incomplete parameters in the second command).

any ideas where i am slipping?

[chsh]

Originally posted here by NullDevice
[root@MDK10 firewall]# iptables -I INPUT 1 -p tcp --syn --dport 80 -m connlimit ! --connlimit-above 2 -j ACCEPT
iptables: No chain/target/match by that name.

Remove the exclamation mark (!) and see if that fixes the problem. For what you are doing, you can equally do --connlimit-above 2 -j DROP/REJECT. I believe that is the intended use of the connlimit module.

[chsh]

Originally posted here by NullDevice
[root@MDK10 firewall]# iptables -I INPUT 1 -p tcp --syn --dport 80 -m connlimit ! --connlimit-above 2 -j ACCEPT
iptables: No chain/target/match by that name.

Remove the exclamation mark (!) and see if that fixes the problem. For what you are doing, you can equally do --connlimit-above 2 -j DROP/REJECT. I believe that is the intended use of the connlimit module.

[NullDevice]

that too doesnt works buddy. i have already tried that

[NullDevice]

that too doesnt works buddy. i have already tried that

[steve.milner]

Can't see the problem, it looks very similar to this example:

http://www.netfilter.org/patch-o-mat...base-connlimit

Are you sure this works on INPUT ? Allthough common sense says it should.

Steve

[steve.milner]

Can't see the problem, it looks very similar to this example:

http://www.netfilter.org/patch-o-mat...base-connlimit

Are you sure this works on INPUT ? Allthough common sense says it should.

Steve

[NullDevice]

sorry steve that too wont work coz u need to operate on one of chains only. have alook below

[root@MDK10 firewall]# iptables -p tcp --syn --dport 80 -m connlimit ! --connlimit-above 2 -j ACCEPT
iptables v1.2.9: no command specified
Try `iptables -h' or 'iptables --help' for more information.

[NullDevice]

sorry steve that too wont work coz u need to operate on one of chains only. have alook below

[root@MDK10 firewall]# iptables -p tcp --syn --dport 80 -m connlimit ! --connlimit-above 2 -j ACCEPT
iptables v1.2.9: no command specified
Try `iptables -h' or 'iptables --help' for more information.