I wanted to set a limit to the number of concurrent connections allowed on my web server. I tried the following rules on an iptables (v1.4.19.1) kernel 3.14.4-200.fc20.x86_64 with a default DROP policy for the INPUT chain under filter table:-A INPUT -p tcp --dport 80 -m connlimit --connlimit-upto 10 -j WEB-A WEB -j ACCEPTThen, I hit the server with 50 concurrent connections using apache benchmark:$ ab -kc 50 -t 10 http://mysite.com/But, when I look at my server access log, I can still see a few hundred lines of successful requests. I am expecting the connlimit rule to kick in and drop all connections. Is there something wrong with my rules or my interpretation of concurrent connections?
How does connlimit in iptables supposed to work?
iptables
After much testing, I found out that having a default drop policy is not enough,*filter-F-X:INPUT DROP [0:0]It is very important not to assume that it would be followed. The connlimit rule would only kick in if you explicitly add a drop rule at the end of the chain:-A INPUT -j DROPIt works now even at a lower concurrency than the limit specified:$ ab -kc 7 -t 6 http://mysite.com/This is ApacheBench, Version 2.3 <$Revision: 1554214 $>Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/Licensed to The Apache Software Foundation, http://www.apache.org/Benchmarking mysite.com (be patient)apr_pollset_poll: The timeout specified has expired (70007)The important thing is to test. Not sure if you would classify this as a bug though.