limit connections from ip to each port? [INACTIVE]

[Visitante]

how to limit connections from ip to each port

np: I want to limit download and upload connections from ip x.x.x.x to port 4662 (emule) it is posible ?

plz help

[Hamski]

it is my post i forgot to log in :) ok plz help

[reset]

it's intersting for me too.

[andrefellows]

I think this is possible using QOS not for ports but IPs.
I don´t know how to do this 'cos I don't need this service.. my lan is just 2 computers at full trhotle ;)

Sorry about my english...

Se ya l8er!

[Hamski]

and what ? no idea ?

[André Simões]

You can make a QoS class for that IP, and put a speed limit on it.
All the trafic for that IP will be limited by this rule.

[Hamski]

I know that! This is a speed limit i want connect limit

[dougie173]

I think it can be done

This page describes how to do it manually setting iptables:-

http://www.clarkconnect.org/forums/showflat.php?Cat=&Board=netmanage&Number=77919&Main=77909

[robsoniq]

I think that add in future to BR_FW function to limit connections per IP (in web admin) is a good idea. We should ask Claudio if it's possible. I'm sure that wish-list for BR_FW is very long :D

[Claudio]

Good ideia. Registered.

[kdiamond]

Yeah indeed!

Too many connections are killing my ADSL modem, and even when bandwidth is very low, no one could browse, because P2P programs opens so many connections.

Setting a max connection number per IP would be a must.

Thx

Br,
Dali

[pcpilot]

ZyXEL P314 alike products use also
sessions control for per IP assigned to its DHCP clients.

It's a good method to limit per user not to open too many sessions and
also a good method to avoid crashing the IP sharing device due to
seesions resource was used out.

(Device provides option to limit max. sessions number per IP can establish ,
for example , total is 2048 for the P314 router , for 8 clients to share ,
I will set the max. sessions number as 255 (2048/8 ) , for example.)

Then each user will not be able to get more than 255 sessions.
that means only if user has to cut some existed sessions
(lower the P2P , for example , sessions) then user can establish
new session for other application (like http , or something else.)
or user will be not able to open any TCP/IP session anymore.

Maybe it can be added to BrazilFW's wish list.

[Claudio]

Maybe it can be added to BrazilFW's wish list.

It´s there already.

[yeager]

its allready added?

[andrefellows]

Seach in Spanish forum for "Argento QOS" they made this kind of control

[yeager]

im still waiting fot Argento QOS and Argento Bridge english tutorial.
Hey MASTERS how long time must waiting?

[andrefellows]

search for "ip_conntrack" spanish !!

[Marcos do Vale]

Código: Selecionar todos

iptables -t mangle -I POSTROUTING -p tcp -m state ! --state RELATED -m connlimit --connlimit-above 12 --connlimit-mask 32 -j DROP

[yeager]

search for "ip_conntrack" spanish !!

here is the problem, i dont speek spanish :(

Code:
iptables -t mangle -I POSTROUTING -p tcp -m state ! --state RELATED -m connlimit --connlimit-above 12 --connlimit-mask 32 -j DROP

where put this lines

i have found addon conlimit, but from last wortre on this forum, not work.

[andrefellows]

put this rule in "simple firewall" as a Custom Firewall rules at the end of the file and put an empty line at the end of the file

[yeager]

and wath is a result of this?

[andrefellows]

the IP cannot open more than 12 concurrent connections

[yeager]

and when i will set conlimit only for ip 192.168.1.100 is this right
iptables -t mangle -I POSTROUTING -p tcp -m state ! --state RELATED -m connlimit --connlimit-above 12 --connlimit-ip 192.168.1.100 -j DROP

[andrefellows]

yes you're right. you can also put a network mask instead just an ip like:

iptables -t mangle -I POSTROUTING -p tcp -m state ! --state RELATED -m connlimit --connlimit-above 12 --connlimit-ip 192.168.1.0/24 -j DROP

[yeager]

is it possible to see real time, how many connections have opened each users

[andrefellows]

i made a test: I put the connlimit in 3 and I did a download with "Free Download Manager".
My configuration in FDM is to open 5 concurrent connections, when i applied the connlimit, just 3 connections was made and even if I try to navigate somewhere else, i'll get no results.

By the way, I have a doubt, if the CONNLIMIT is set to a network, the limit used, as example above 3, is for each ip or for the entire network?

cheers