Pablo M. Bermudo Garay | 340105f | 2017-03-31 14:34:38 +0200 | [diff] [blame] | 1 | iptables-translate -A OUTPUT -m tcp -p tcp --dport 443 -m hashlimit --hashlimit-above 20kb/s --hashlimit-burst 1mb --hashlimit-mode dstip --hashlimit-name https --hashlimit-dstmask 24 -m state --state NEW -j DROP |
shyam saini | 13ecaeb | 2018-01-27 00:11:16 +0530 | [diff] [blame] | 2 | nft add rule ip filter OUTPUT tcp dport 443 meter https { ip daddr and 255.255.255.0 timeout 60s limit rate over 20 kbytes/second burst 1 mbytes} ct state new counter drop |
Pablo M. Bermudo Garay | 340105f | 2017-03-31 14:34:38 +0200 | [diff] [blame] | 3 | |
| 4 | iptables-translate -A OUTPUT -m tcp -p tcp --dport 443 -m hashlimit --hashlimit-upto 300 --hashlimit-burst 15 --hashlimit-mode srcip,dstip --hashlimit-name https --hashlimit-htable-expire 300000 -m state --state NEW -j DROP |
shyam saini | 13ecaeb | 2018-01-27 00:11:16 +0530 | [diff] [blame] | 5 | nft add rule ip filter OUTPUT tcp dport 443 meter https { ip daddr . ip saddr timeout 300s limit rate 300/second burst 15 packets} ct state new counter drop |