iptables command

hello,
i need set limit perconnection to my server by iptables
i try:
[root@host ~]#  iptables -t nat -A PREROUTING -i $EXT_IFACE eth0 -p tcp -syn -d $DEST_IP -m iplimit --iplimit -above 16 -j DROP
but iptables say error:
Bad argument `iplimit'
Try `iptables -h' or 'iptables --help' for more information.
how to good command for limit connection to server
likeinfoAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Gabriel OrozcoSolution ArchitectCommented:
as you can see here
http://www.netfilter.org/documentation/HOWTO/netfilter-extensions-HOWTO-3.html#ss3.5

iplimit is not already implemented on the mayority of kernels. you should patch a kernel so you can have this math in iptables (it also requires you an up-to-date iptables)

here you have some info in how to compile extensions for iptables:
http://www.netfilter.org/documentation/HOWTO/netfilter-extensions-HOWTO.html

howver, I'm seeing that debian has this patch, so maybe you need to load the module in order to use it:
modprobe ipt_iplimit

if you get an error modprobing the module, then you do not have iplimit compiled in the kernel. if you get nothing but the command line again, then try your rule again =)
ahoffmannCommented:
# somthing like:
iptables -I FORWARD -p tcp --dport 80 -d IP   --syn -m dstlimit --dstlimit-mode srcipdstip-dstport --dstlimit 1/sec -j ACCEPT
iptables -A FORWARD -p tcp --dport 80 -d IP ! --syn -j ACCEPT
iptables -A FORWARD -p tcp --dport 80 -d IP   --syn -j DROP
# allows an average of 1 syn/sec and max. 5 syns in a burst.
likeinfoAuthor Commented:
error:
iptables -I FORWARD -p tcp --dport 80 -d IP   --syn -m dst                                                                             limit --dstlimit-mode srcipdstip-dstport --dstlimit 1/sec -j ACCEPT
iptables v1.2.11: Couldn't load match `dstlimit':/lib/iptables/libipt_dstlimit.s                                                                             o: cannot open shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.
CompTIA Network+

Prepare for the CompTIA Network+ exam by learning how to troubleshoot, configure, and manage both wired and wireless networks.

Gabriel OrozcoSolution ArchitectCommented:
try with haslimit insetad dstlimit, since is deprecated:
http://www.netfilter.org/patch-o-matic/pom-obsolete.html

of course, your linux distribution should have patch-o-match included (this includes a patched kernel) so you need to try and check if it works

if not, then add the patch-o-matic (need to read the documentation):
http://www.netfilter.org/patch-o-matic/
likeinfoAuthor Commented:
i'm running iptables v1.2.8
how can i fix for use this command?
Gabriel OrozcoSolution ArchitectCommented:
well

if you read the patch-o-matic howto, you'll see you need to download and install a newer iptables, along with the process of downloading the patch, apply to a kernel source, and then compile and install the new kernel.

if that is too much for you to do at current state, then maybe you need to give a re-read to my first post where are the links to iproute2 commands that can be of help.

these come already with all linux distributions nowadays

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Gabriel OrozcoSolution ArchitectCommented:
thanks
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Linux Networking

From novice to tech pro — start learning today.