1*a71a9546SAutomerger Merge WorkerAllows you to restrict the number of parallel connections to a server per 2*a71a9546SAutomerger Merge Workerclient IP address (or client address block). 3*a71a9546SAutomerger Merge Worker.TP 4*a71a9546SAutomerger Merge Worker\fB\-\-connlimit\-upto\fP \fIn\fP 5*a71a9546SAutomerger Merge WorkerMatch if the number of existing connections is below or equal \fIn\fP. 6*a71a9546SAutomerger Merge Worker.TP 7*a71a9546SAutomerger Merge Worker\fB\-\-connlimit\-above\fP \fIn\fP 8*a71a9546SAutomerger Merge WorkerMatch if the number of existing connections is above \fIn\fP. 9*a71a9546SAutomerger Merge Worker.TP 10*a71a9546SAutomerger Merge Worker\fB\-\-connlimit\-mask\fP \fIprefix_length\fP 11*a71a9546SAutomerger Merge WorkerGroup hosts using the prefix length. For IPv4, this must be a number between 12*a71a9546SAutomerger Merge Worker(including) 0 and 32. For IPv6, between 0 and 128. If not specified, the 13*a71a9546SAutomerger Merge Workermaximum prefix length for the applicable protocol is used. 14*a71a9546SAutomerger Merge Worker.TP 15*a71a9546SAutomerger Merge Worker\fB\-\-connlimit\-saddr\fP 16*a71a9546SAutomerger Merge WorkerApply the limit onto the source group. This is the default if 17*a71a9546SAutomerger Merge Worker\-\-connlimit\-daddr is not specified. 18*a71a9546SAutomerger Merge Worker.TP 19*a71a9546SAutomerger Merge Worker\fB\-\-connlimit\-daddr\fP 20*a71a9546SAutomerger Merge WorkerApply the limit onto the destination group. 21*a71a9546SAutomerger Merge Worker.PP 22*a71a9546SAutomerger Merge WorkerExamples: 23*a71a9546SAutomerger Merge Worker.TP 24*a71a9546SAutomerger Merge Worker# allow 2 telnet connections per client host 25*a71a9546SAutomerger Merge Workeriptables \-A INPUT \-p tcp \-\-syn \-\-dport 23 \-m connlimit \-\-connlimit\-above 2 \-j REJECT 26*a71a9546SAutomerger Merge Worker.TP 27*a71a9546SAutomerger Merge Worker# you can also match the other way around: 28*a71a9546SAutomerger Merge Workeriptables \-A INPUT \-p tcp \-\-syn \-\-dport 23 \-m connlimit \-\-connlimit\-upto 2 \-j ACCEPT 29*a71a9546SAutomerger Merge Worker.TP 30*a71a9546SAutomerger Merge Worker# limit the number of parallel HTTP requests to 16 per class C sized \ 31*a71a9546SAutomerger Merge Workersource network (24 bit netmask) 32*a71a9546SAutomerger Merge Workeriptables \-p tcp \-\-syn \-\-dport 80 \-m connlimit \-\-connlimit\-above 16 33*a71a9546SAutomerger Merge Worker\-\-connlimit\-mask 24 \-j REJECT 34*a71a9546SAutomerger Merge Worker.TP 35*a71a9546SAutomerger Merge Worker# limit the number of parallel HTTP requests to 16 for the link local network 36*a71a9546SAutomerger Merge Worker(ipv6) 37*a71a9546SAutomerger Merge Workerip6tables \-p tcp \-\-syn \-\-dport 80 \-s fe80::/64 \-m connlimit \-\-connlimit\-above 38*a71a9546SAutomerger Merge Worker16 \-\-connlimit\-mask 64 \-j REJECT 39*a71a9546SAutomerger Merge Worker.TP 40*a71a9546SAutomerger Merge Worker# Limit the number of connections to a particular host: 41*a71a9546SAutomerger Merge Workerip6tables \-p tcp \-\-syn \-\-dport 49152:65535 \-d 2001:db8::1 \-m connlimit 42*a71a9546SAutomerger Merge Worker\-\-connlimit-above 100 \-j REJECT 43