This is the version of apache we're using - httpd-2.2.15-39.el6.centos.x86_64
We recently had our website down due to DoS attack and hence started exploring iptables, and how to use it to prevent DoS attacks. Came across several forums and have enough set of rules that I am trying to understand now. To put a cap on number of connections made from single ip, I wanted to understand the communication between client (web browser) and server (webserver - httpd). Say, I am hitting "www.mywebsite.com" in my google chrome, and then started going through various pages of my website. Now, how many connections are being made between the client and the webserver. I tried running netstat in my webserver and check. I can only see one connection being made with my IP (chrome web browser). Is it always the case? Only 1 connection is made between the client and webserver and communication happens only through this one connection? How long this connection stays?
Is it safe to use the below rules?
iptables -I INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set iptables -I INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 -j DROP
The above 2 rules will completely rule out the risk of the scenario where one is trying to make so many connections to my webserver from his machine (considering 10 connections per minute isn't legitimate?)?
Now, consider the below 2 rules
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m limit --limit 50/minute --limit-burst 200 -j ACCEPT iptables -A INPUT -p tcp --dport 80 -m state --state RELATED,ESTABLISHED -m limit --limit 50/second --limit-burst 50 -j ACCEPT
Now, what does the above rule do? I have already asked this in below question, but still couldn't get a complete picture on this.
Does the first rule says that only 50 connections per minute are accepted and it can burst up to 200. Once 200 connections per minute are accepted, in the consecutive minute, only 50 are accepted.
Regarding limit burst, it starts with 200 tokens in it. which means say my webserver received 200 requests in this minute, then the token count goes to 50 and only 50 connections are accepted for next minute. Now, what happens in the 3rd minute, will it again allow 200 requests? as in the previous minute, the number of connections was <=50? Is my understanding right?
And what does the last rule says? At any given point, there can only be 50 established connections?
Are there chances of legitimate traffic being dropped due to the above 2 rules?
If there are any other iptables rule that you would suggest to prevent DoS attacks and in general, for a webserver?