LARTC
[Top] [All Lists]

Re: [LARTC] Strategy for penalising IPs with too many simultaneous sessi

To: Graham Leggett <minfrin@sharp.fm>
Subject: Re: [LARTC] Strategy for penalising IPs with too many simultaneous sessions
From: Andrew Beverley <andy@andybev.com>
Date: Sun, 05 Nov 2006 21:47:19 +0000
Cc: lartc@mailman.ds9a.nl
Delivered-to: sp-com-lists@consult.net
Delivered-to: lartc-list@securepoint.com
Delivered-to: lartc@outpost.ds9a.nl
In-reply-to: <454C762C.2040207@sharp.fm>
List-archive: <http://mailman.ds9a.nl/pipermail/lartc>
List-help: <mailto:lartc-request@mailman.ds9a.nl?subject=help>
List-id: "Mailinglist of the Linux Advanced Routing &amp; Traffic Control project" <lartc.mailman.ds9a.nl>
List-post: <mailto:lartc@mailman.ds9a.nl>
List-subscribe: <http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc>, <mailto:lartc-request@mailman.ds9a.nl?subject=subscribe>
List-unsubscribe: <http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc>, <mailto:lartc-request@mailman.ds9a.nl?subject=unsubscribe>
References: <454BDA1F.2010301@sharp.fm> <454BEEFC.4030707@vsnl.com> <454C762C.2040207@sharp.fm>
Sender: lartc-bounces@mailman.ds9a.nl
> What I would like to do instead is allow the user to use any protocol 
> they like, with the caveat that attempting to open many connections 
> simultaneously will result in a steadily decreasing share of the pipe, 
> rather than a steadily increasing one.

I solved this in a similar but slightly different way. I use connlimit
to monitor for when a user has 5 or more connections on ports above
1024. When they have, they are dropped into an ipset; all their traffic
is then monitored and any traffic on ports above 1024 is dropped to a
very low priority.

This has the advantage that web browsing they do is unaffected. Also,
it's slightly safer than your proposed method - I have seen instances
when just normal surfing of the web can create 5 connections or more.

Something like this (eth0 is the user's network):

iptables -t mangle -A PREROUTING -p tcp -i eth0 --dport 1024: -m \
connlimit --connlimit-above 5 -j SET --add-set p2p src

iptables -t mangle -A FORWARD -o eth0 -p tcp -m multiport --sport \
1024:65535 -m set --set p2p dst -j MARK --set-mark 60

iptables -t mangle -A FORWARD -i eth0 -p tcp -m multiport --dport \
1024:65535 -m set --set p2p src -j MARK --set-mark 60

You'll have to compile your kernel with ipset and connlimit support.

Andy Beverley


_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

<Prev in Thread] Current Thread [Next in Thread>