Currently using Centos6.7 and looking to put some limits in place to stop say user x from ip y from making more than say 5 connections. Say he logs in 5 times, those 5 will establish but the 6th will be rejected.
Looking in to using connlimit to do this but feel like I'm missing something and I'm slightly gun shy around putting the rule in place as I've inadvertently locked myself out of the server in the past putting a rule in the wrong spot (oops).
Notes: Not looking to specify a port. x.x.x.1 and x.x.x.2 are IP's with higher limits of 50 so I put those rules first, I believe that's correct?
I have the below:
-A INPUT -p tcp -s x.x.x.1 --syn -m connlimit --connlimit-above 50 -j REJECT -A INPUT -p tcp -s x.x.x.2 --syn -m connlimit --connlimit-above 50 -j REJECT -A INPUT -p tcp --syn -m connlimit --connlimit-above 5 -j REJECT
Does this look correct? Is there a different way to go about this? I don't want to limit to a pool of only 5 connections total but 5 per IP address.