iptables and connlimit

helloo friends,

i was just working with iptables and connlimit and facing a little bit of problem i hope u peep can help me out very well.

pls have a look on the command that i executed after fresh installation of iptables from rpm.

[root@MDK10 firewall]# iptables -I INPUT 1 -p tcp --syn --dport 80 -m connlimit ! --connlimit-above 2 -j ACCEPT
iptables: No chain/target/match by that name.

but have a look at this toooo

[root@MDK10 firewall]# iptables -I INPUT 1 -p tcp --syn --dport 80 -m connlimit -j ACCEPT
iptables v1.2.9: You must specify `--connlimit-above'

so connlimit is there and modules gets loaded ( i suppose, coz it shows me the error for incomplete parameters in the second command).

any ideas where i am slipping?

helloo friends,

i was just working with iptables and connlimit and facing a little bit of problem i hope u peep can help me out very well.

pls have a look on the command that i executed after fresh installation of iptables from rpm.

[root@MDK10 firewall]# iptables -I INPUT 1 -p tcp --syn --dport 80 -m connlimit ! --connlimit-above 2 -j ACCEPT
iptables: No chain/target/match by that name.

but have a look at this toooo

[root@MDK10 firewall]# iptables -I INPUT 1 -p tcp --syn --dport 80 -m connlimit -j ACCEPT
iptables v1.2.9: You must specify `--connlimit-above'

so connlimit is there and modules gets loaded ( i suppose, coz it shows me the error for incomplete parameters in the second command).

any ideas where i am slipping?

Quote:

---

Originally posted here by NullDevice
[root@MDK10 firewall]# iptables -I INPUT 1 -p tcp --syn --dport 80 -m connlimit ! --connlimit-above 2 -j ACCEPT
iptables: No chain/target/match by that name.

---

Remove the exclamation mark (!) and see if that fixes the problem. For what you are doing, you can equally do --connlimit-above 2 -j DROP/REJECT. I believe that is the intended use of the connlimit module.

Quote:

---

Originally posted here by NullDevice
[root@MDK10 firewall]# iptables -I INPUT 1 -p tcp --syn --dport 80 -m connlimit ! --connlimit-above 2 -j ACCEPT
iptables: No chain/target/match by that name.

---

Remove the exclamation mark (!) and see if that fixes the problem. For what you are doing, you can equally do --connlimit-above 2 -j DROP/REJECT. I believe that is the intended use of the connlimit module.

that too doesnt works buddy. i have already tried that

that too doesnt works buddy. i have already tried that

Can't see the problem, it looks very similar to this example:

http://www.netfilter.org/patch-o-mat...base-connlimit

Are you sure this works on INPUT ? Allthough common sense says it should.

Steve

Can't see the problem, it looks very similar to this example:

http://www.netfilter.org/patch-o-mat...base-connlimit

Are you sure this works on INPUT ? Allthough common sense says it should.

Steve

sorry steve that too wont work coz u need to operate on one of chains only. have alook below

[root@MDK10 firewall]# iptables -p tcp --syn --dport 80 -m connlimit ! --connlimit-above 2 -j ACCEPT
iptables v1.2.9: no command specified
Try `iptables -h' or 'iptables --help' for more information.

sorry steve that too wont work coz u need to operate on one of chains only. have alook below

[root@MDK10 firewall]# iptables -p tcp --syn --dport 80 -m connlimit ! --connlimit-above 2 -j ACCEPT
iptables v1.2.9: no command specified
Try `iptables -h' or 'iptables --help' for more information.

please take a look here
http://www.mail-archive.com/leaf-use.../msg16744.html
i think is the same problem that u r reporting here.

/edit
maybe u dont have the support. But u can download it thru netfilter patch-o-matic.

please take a look here
http://www.mail-archive.com/leaf-use.../msg16744.html
i think is the same problem that u r reporting here.

/edit
maybe u dont have the support. But u can download it thru netfilter patch-o-matic.

cacosapo...man his question was never answered. :(
same is teh prob with me. i am not getting a solution to it.

Sorry, i didnt enter on much detail.
Basically that post is pointing that connlimit is a NEW feature. You need a new iptables, but as was posted before here, u can get it (connlimit support) thru patch-o-matic feature of netfilter. The support for that comes with kernel 2.4.26 (or 24) i suppose.
I hope that helps you now.