This is the version of apache we're using - httpd-2.2.15-39.el6.centos.x86_64

We recently had our website down due to DoS attack and hence started exploring iptables, and how to use it to prevent DoS attacks. Came across several forums and have enough set of rules that I am trying to understand now. To put a cap on number of connections made from single ip, I wanted to understand the communication between client (web browser) and server (webserver - httpd). Say, I am hitting "www.mywebsite.com" in my google chrome, and then started going through various pages of my website. Now, how many connections are being made between the client and the webserver. I tried running netstat in my webserver and check. I can only see one connection being made with my IP (chrome web browser). Is it always the case? Only 1 connection is made between the client and webserver and communication happens only through this one connection? How long this connection stays?

Is it safe to use the below rules?

iptables -I INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 -j DROP

The above 2 rules will completely rule out the risk of the scenario where one is trying to make so many connections to my webserver from his machine (considering 10 connections per minute isn't legitimate?)?

Now, consider the below 2 rules

iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m limit --limit 50/minute --limit-burst 200 -j ACCEPT

iptables -A INPUT -p tcp --dport 80 -m state --state RELATED,ESTABLISHED -m limit --limit 50/second --limit-burst 50 -j ACCEPT

Now, what does the above rule do? I have already asked this in below question, but still couldn't get a complete picture on this.

Does the first rule says that only 50 connections per minute are accepted and it can burst up to 200. Once 200 connections per minute are accepted, in the consecutive minute, only 50 are accepted.

Regarding limit burst, it starts with 200 tokens in it. which means say my webserver received 200 requests in this minute, then the token count goes to 50 and only 50 connections are accepted for next minute. Now, what happens in the 3rd minute, will it again allow 200 requests? as in the previous minute, the number of connections was <=50? Is my understanding right?

And what does the last rule says? At any given point, there can only be 50 established connections?

Are there chances of legitimate traffic being dropped due to the above 2 rules?

If there are any other iptables rule that you would suggest to prevent DoS attacks and in general, for a webserver?


how many connections are being made between the client and the webserver.

Typically a browser will make 6-10 tcp connections to a webserver.
I test with chrome and this is what I see. I usually test with end to end test runner which rapidly makes requests, so you may need to adjust your setup or netstat command - I usally start with netstat -plunt or something similar.
Maybe you are seeing less because you are hitting same url and the browser is caching - try request different pages.

How long are connections kept alive?

This is set in a directive keepalive in apache - its usually set around 5-10 seconds depending on apache version - just grep for it. Sometimes its set lower - or off - for performance reasons - but if you are the only one managing the server then you would know about this.
If it was turned down to zero, that might be the reason why your netstat command isnt picking up the connections - because they being released before netstat reports them.

iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m limit --limit 50/minute --limit-burst 200 -j ACCEPT

Firstly this rule appends - to the end of your existing rule set, which means if any other rules match before it, this rule wont even be considered.
It's from the netfilter limit module which uses a token bucket concept for the math. In this case, 200 tokens are put in the bucket, the rule will match until all the tokens are consumed - i.e. the bucket is emptied.
But the bucket is constantly being replenished at the rate of 50 per minute.
So the basic idea is say you want to match an average of 50 times per minute - and you want to continue matching 50 requests per minute all day long.
Well what if someone makes 120 requests all in a burst, but then makes no requests for the next 3 minutes?, well they are technically within your definition of 50 times per minute - average.
So you need to put a few extra token in the bucket to cover this.

For more info see the netfilter documentation


To prevent DoS attacks you have to dig into the networking layer. Search for "DoS attack Linux", consult the networking guide for your distribution. Most of the mitigations play with limiting traffic using iptables.


Optimize Directive MaxRequestWorkers to define the maximum number of simultaneous connections over which the resources are exhausted.See also the Apache Performance Tuning

Using a mpm Module threaded lets you treat advantage of simultaneous connections, which minimizes the effect of DoS attacks. In the future, the mpm Module event will use asynchronous processing so as not to dedicate a thread for each connection. By the nature of the OpenSSL library, the mpm Module event is currently incompatible with the module mod_ssl and other input filters. In these cases, their behavior is reduced to that of the module mpm worker .

There are many third party modules available List_of_Apache_modules that can shrink behavior of some customers and minimize the problems of DoS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.