{"id":18,"date":"2006-12-26T11:36:10","date_gmt":"2006-12-26T09:36:10","guid":{"rendered":"http:\/\/antynet.pl\/word\/?p=18"},"modified":"2010-08-24T11:36:39","modified_gmt":"2010-08-24T09:36:39","slug":"netfilter-limit","status":"publish","type":"post","link":"https:\/\/www.antynet.pl\/index.php\/2006\/12\/26\/netfilter-limit\/","title":{"rendered":"Netfilter – limit"},"content":{"rendered":"

LIMIT<\/p>\n

1) iptables -A FORWARD -p tcp –dport 3000 -m limit –limit 3\/minute –limit-burst 4 -j ACCEPT
\n2) iptables -A FORWARD -p tcp –dport 3000 -j DROP<\/p>\n

1) Gdy wskazany pakiet wyst\u0105pi pierwszy raz to wykonaj regu\u0142\u0119 ACCEPT na czterech pakietach, nast\u0119pnie czekaj przez czas okre\u015blony wsp\u00f3\u0142czynnnikiem 3\/minute tzn. 20 sekund i wykonaj regu\u0142\u0119 ACCEPT na jednym pakiecie, ale je\u015bli po 20 sekundach nie pojawi si\u0119 \u017caden wskazany pakiet a pojawi si\u0119 dopiero po 40 sekundach od pierwszych trzech to zastosuj regu\u0142\u0119 do dw\u00f3ch pakiet\u00f3w, ale je\u015bli ani po 20 ani po 40 nie pojawi si\u0119 \u017caden wskazany pakiet a pojawi si\u0119 dopiero po 60 sekundach od pierwszych trzech to zastosuj regu\u0142\u0119 do trzech pakiet\u00f3w itd.
\nJak pisze Bromirski, ka\u017cde 20 sekund kt\u00f3re minie bez pakietu, kt\u00f3ry pasowa\u0142by do tej regu\u0142y, spowoduje odnowienie jednego numeru z serii, je\u015bli \u017caden pakiet nie b\u0119dzie pasowa\u0142 do regu\u0142y w ci\u0105gu 80 sekund, seria zostanie w pe\u0142ni odnowiona do 4 sztuk tak jak zacz\u0119li\u015bmy.<\/p>\n

IIII <—- 20s —-> I
\nIIII <—- 20s —-> <—- 20s —-> II
\nIIII <—- 20s —-> <—- 20s —-> <—- 20s —-> III
\nIIII <—- 20s —-> <—- 20s —-> <—- 20s —-> <—- 20s —-> IIII<\/p>\n

–limit x\/second,minute,hour,day okre\u015bla przedzia\u0142 czasowy pomi\u0119dzy seriami
\n–limit-burst x okre\u015bla ilo\u015b\u0107 pakiet\u00f3w w pierwszej serii<\/p>\n","protected":false},"excerpt":{"rendered":"

LIMIT 1) iptables -A FORWARD -p tcp –dport 3000 -m limit –limit 3\/minute –limit-burst 4 -j ACCEPT 2) iptables -A FORWARD -p tcp –dport 3000 -j DROP 1) Gdy wskazany pakiet wyst\u0105pi pierwszy raz to wykonaj regu\u0142\u0119 ACCEPT na czterech pakietach, nast\u0119pnie czekaj przez czas okre\u015blony wsp\u00f3\u0142czynnnikiem 3\/minute tzn. 20 sekund i wykonaj regu\u0142\u0119 ACCEPT […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[6,3],"tags":[],"class_list":["post-18","post","type-post","status-publish","format-standard","hentry","category-iptables","category-uslugi"],"_links":{"self":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts\/18","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/comments?post=18"}],"version-history":[{"count":1,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts\/18\/revisions"}],"predecessor-version":[{"id":19,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts\/18\/revisions\/19"}],"wp:attachment":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/media?parent=18"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/categories?post=18"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/tags?post=18"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}