0

I'm trying to set up some basic DOS protection. The following iptables rule works on a CentOS box but NOT on debian (wheezy). 

#limit the parallel http requests to 50 per class C sized network    
iptables  -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 50 --connlimit-mask 24 -j REJECT --reject-with tcp-reset

I'm using the GoldenEye DOS tool (among others), and in the CentOS connections are successfully denied, however in the debian box nothing happens (CPU goes up to 100%, apache becomes unresponsive)

Any idea of what might be happening? The rule is succesfully added to the IPTABLES rule list

root@bedrock ~ # iptables -L | grep httpflags
REJECT     tcp  --  anywhere             anywhere             tcp dpt:httpflags: FIN,SYN,RST,ACK/SYN #conn src/24 > 50 reject-with tcp-reset

root@bedrock ~ # cat /etc/*-release
PRETTY_NAME="Debian GNU/Linux 7 (wheezy)"
NAME="Debian GNU/Linux"
VERSION_ID="7"
VERSION="7 (wheezy)"
ID=debian
ANSI_COLOR="1;31"
HOME_URL="http://www.debian.org/"
SUPPORT_URL="http://www.debian.org/support/"
BUG_REPORT_URL="http://bugs.debian.org/"

root@bedrock ~ # lsmod | grep ip
xt_multiport           12548  12
ipt_REJECT             12502  3
ipt_LOG                12605  8
iptable_mangle         12536  0
iptable_nat            12928  0
nf_nat                 18242  1 iptable_nat
nf_conntrack_ipv4      14078  16 nf_nat,iptable_nat
nf_defrag_ipv4         12483  1 nf_conntrack_ipv4
nf_conntrack           52720  5 nf_conntrack_ipv4,nf_nat,iptable_nat,xt_state,xt_connlimit
ip6table_filter        12540  0
ip6_tables             22175  1 ip6table_filter
iptable_filter         12536  1
ip_tables              22042  3 iptable_filter,iptable_nat,iptable_mangle
x_tables               19118  14 ip_tables,iptable_filter,ip6_tables,ip6table_filter,iptable_nat,iptable_mangle,xt_tcpudp,xt_state,xt_limit,ipt_LOG,ipt_REJECT,xt_multiport,xt_recent,xt_connlimit
HopelessN00b
  • 53,385
  • 32
  • 133
  • 208
Iraklis
  • 488
  • 1
  • 5
  • 14
  • Do you have more rules in INPUT chain that might interfere (specially any containing ACCEPT)? Can you paste a `iptables -nvL INPUT` ? – LatinSuD Jun 09 '14 at 10:26
  • We really need to see the full state of your iptables INPUT chain `iptables -L -vn`. – user9517 Jun 09 '14 at 10:26

1 Answers1

1

This will almost certainly be a rule ordering issue. Iptables/netfilter stops processing packets when a rule matches. Using the -A switch adds rules to the end of the chain so it's likely that you have an earlier rule that causes processing to stop.

user9517
  • 114,104
  • 20
  • 206
  • 289
  • Thanks Iain, moved the rule to the top of the INPUT chain and it now gets triggered. Cheers! – Iraklis Jun 09 '14 at 11:09
  • Just for the record, if you use `-I` instead of `-A` it will place the rule at the begining of the chain. – LatinSuD Jun 09 '14 at 11:36
  • 2
    @Iraklis In this sort of case you really should define your own chain and throw all your rules in it. Makes things much cleaner and helps avoid problems like this. – Michael Hampton Jun 09 '14 at 12:03