From owner-freebsd-questions Sat Mar 30 8:50:57 2002 Delivered-To: freebsd-questions@freebsd.org Received: from mail.mango-bay.com (mail.mango-bay.com [208.206.15.12]) by hub.freebsd.org (Postfix) with ESMTP id 699F337B41C for ; Sat, 30 Mar 2002 08:50:50 -0800 (PST) Received: from barbish ([63.70.155.110]) by mail.mango-bay.com (Post.Office MTA v3.5.3 release 223 ID# 0-52377U2500L250S0V35) with SMTP id com for ; Sat, 30 Mar 2002 11:49:14 -0500 From: "Joe & Fhe Barbish" To: "FBSDQ" Subject: FBSD 4.5 ipfw new option limit Date: Sat, 30 Mar 2002 11:49:12 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Importance: Normal Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG In FBSD version 4.5 there is a new ipfw rule option called limit. Below is the man page on this option. ******************************************************************* limit {src-addr | src-port | dst-addr | dst-port} N The firewall will only allow N connections with the same set of parameters as specified in the rule. One or more of source and destination addresses and ports can be specified. To limit the number of connections a user can open you can use the following type of rules: ipfw add allow tcp from my-net/24 to any setup limit src-addr 10 ipfw add allow tcp from any to me setup limit src-addr 4 The former (assuming it runs on a gateway) will allow each host on a /24 network to open at most 10 TCP connections. The latter can be placed on a server to make sure that a single client does not use more than 4 simultaneous connections. ******************************************************************* I find this verbiage hard to comprehend what the author is trying to say. using this example ipfw add allow tcp from any to me setup limit src-addr 4 Is it saying that for each unique ip address in the src ip address field it will allow up to 4 simultaneous connections. So I would see src_ip_addr 122.33.45.11 accept src_ip_addr 122.33.45.12 accept src_ip_addr 122.33.45.12 accept src_ip_addr 122.33.45.11 accept src_ip_addr 122.33.45.11 accept src_ip_addr 122.33.45.12 accept src_ip_addr 122.33.45.12 accept src_ip_addr 122.33.45.11 accept src_ip_addr 122.33.45.11 rejected or would I see src_ip_addr 122.33.45.11 accept src_ip_addr 122.33.45.12 accept src_ip_addr 122.33.45.12 accept src_ip_addr 122.33.45.11 accept src_ip_addr 122.33.45.11 rejected src_ip_addr 122.33.45.12 rejected src_ip_addr 122.33.45.12 rejected src_ip_addr 122.33.45.11 rejected src_ip_addr 122.33.45.11 rejected How does Limit know when a packet has completed so as the remove it from the count? I guess the real question is what is the limit option really doing and how does he do it? To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message