From owner-freebsd-ipfw@FreeBSD.ORG  Mon Jan 10 22:35:47 2005
Return-Path: <owner-freebsd-ipfw@FreeBSD.ORG>
Delivered-To: freebsd-ipfw@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 1B69816A4CE
	for <freebsd-ipfw@freebsd.org>; Mon, 10 Jan 2005 22:35:47 +0000 (GMT)
Received: from mailserver.sandvine.com (sandvine.com [199.243.201.138])
	by mx1.FreeBSD.org (Postfix) with ESMTP id AB68643D2F
	for <freebsd-ipfw@freebsd.org>; Mon, 10 Jan 2005 22:35:46 +0000 (GMT)
	(envelope-from don@SANDVINE.com)
X-MimeOLE: Produced By Microsoft Exchange V6.0.6603.0
content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Date: Mon, 10 Jan 2005 17:35:46 -0500
Message-ID: <2BCEB9A37A4D354AA276774EE13FB8C219AFB7@mailserver.sandvine.com>
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Thread-Topic: limiting connections
Thread-Index: AcT3Wpe5M79yB7dmSZmHpTzoNOQSSAACgsvw
From: "Don Bowman" <don@SANDVINE.com>
To: "Carl Mark" <carlmarkbsd@hotmail.co.uk>,
	<freebsd-ipfw@freebsd.org>
Subject: RE: limiting connections
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 10 Jan 2005 22:35:47 -0000

From: Carl Mark
> Hello folks,
>=20
> I'm trying to set up a ruleset that limits every user to X=20
> tcp connections, since I have 300 active users on each=20
> server. I've been trying to work it out with the ipfw limit=20
> but I really don't know how effective it is.
>=20
> For example:
>=20
> ipfw -q add 15 allow tcp from me to any 80 limit dst-port X=20
> keep-state out setup
>=20

ipfw add 50 allow tcp from any to any setup limit src-addr 2

would limit any user to 2 concurrent TCP connections.