title: Iptables Prevent Flooding
body: <p>I know you can limit number of connections per ip, per time interval etc, but what I am wanting is amount of data. </p>
  
  <p>I'm hosting a socket server, and I thought rather than making it do the processing to check for flooding - offload it to the firewall. I know you can guard against syn flooding attacks, like mentioned here:</p>
  
  <p><a href="http://www.cyberciti.biz/tips/howto-limit-linux-syn-attacks.html" rel="nofollow">http://www.cyberciti.biz/tips/howto-limit-linux-syn-attacks.html</a></p>
  
  <p>For example:</p>
  
  <pre><code># Limit the number of incoming tcp connections
  # Interface 0 incoming syn-flood protection
  iptables -N syn_flood
  iptables -A INPUT -p tcp --syn -j syn_flood
  iptables -A syn_flood -m limit --limit 1/s --limit-burst 3 -j RETURN
  iptables -A syn_flood -j DROP
  #Limiting the incoming icmp ping request:
  iptables -A INPUT -p icmp -m limit --limit  1/s --limit-burst 1 -j ACCEPT
  iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 1 -j LOG --log-prefix PING-DROP:
  iptables -A INPUT -p icmp -j DROP
  iptables -A OUTPUT -p icmp -j ACCEPT
  </code></pre>
  
  <p>I'm not sure what iptables can do, so the question is a bit vague. But since web-sockets use tcp I should be able to limit number of bytes per second. And flag connections exceeding that limit or just drop them, whatever. </p>
  
  <p>I can't seem to find a good reference on this, as they are all about tracking connections etc, not data transfer. Does anyone know of a good reference or how to do this? Is iptables not a good firewall for this? if not what is?</p>