I wanted to set a limit to the number of concurrent connections allowed on my web server. I tried the following rules on an iptables (v126.96.36.199) kernel 3.14.4-200.fc20.x86_64 with a default DROP policy for the INPUT chain under
-A INPUT -p tcp --dport 80 -m connlimit --connlimit-upto 10 -j WEB -A WEB -j ACCEPT
Then, I hit the server with 50 concurrent connections using apache benchmark:
$ ab -kc 50 -t 10 http://mysite.com/
But, when I look at my server access log, I can still see a few hundred lines of successful requests. I am expecting the
connlimit rule to kick in and drop all connections. Is there something wrong with my rules or my interpretation of concurrent connections?