On 01/10/2018 06:39 AM, teor wrote:
iptables -I INPUT -p tcp --syn ! --dport 22 -m state --state NEW -m recent --set iptables -I INPUT -p tcp --syn ! --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 100 -j DROP
What's about the following approach; IPT="/sbin/iptables"
$IPT -P INPUT DROP $IPT -P OUTPUT ACCEPT $IPT -P FORWARD DROP
# trust already established connections # $IPT -A INPUT --match conntrack --ctstate ESTABLISHED -j ACCEPT $IPT -A INPUT --match conntrack --ctstate RELATED -j ACCEPT $IPT -A INPUT --match conntrack --ctstate INVALID -j DROP
# Tor # for p in 443 80 do $IPT -A INPUT -p tcp --syn --destination-port $p --match connlimit --connlimit-above 2 --connlimit-mask 32 -j DROP $IPT -A INPUT -p tcp --destination-port $p -j ACCEPT done
Those rules should not prevent clients behind a NAT from accessing the relay as long as the clients do not come in in parallel.
Objections ?