1

Running an Ubuntu 16.04 server with Docker Engine (latest version 1.12.1) and a Docker image/container based on Ubuntu 16.04 as well.

I need to limit (on a specific port using TCP) both:

  1. the number of connections per second (let's say 10), and
  2. the number of simultaneous connections

It would be perfect if it is possible to create an entrypoint script inside the Docker container that when loaded handles the iptables setup for this, but if that is not possible then how can I configure this on the host (outside Docker container)?

Currently I have this on the host:

$ iptables -L --line-numbers
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination
1    DOCKER-ISOLATION  all  --  anywhere             anywhere
2    DOCKER     all  --  anywhere             anywhere
3    ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
4    ACCEPT     all  --  anywhere             anywhere
5    ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain DOCKER (1 references)
num  target     prot opt source               destination
1    ACCEPT     tcp  --  anywhere             172.17.0.2           tcp dpt:15672

Chain DOCKER-ISOLATION (1 references)
num  target     prot opt source               destination
1    RETURN     all  --  anywhere             anywhere

How can I add the above two rules to the DOCKER chain if the destination port is lets say port 5671?

0

This is how I would do it:

iptables -A INPUT -p tcp --syn --dport 5671-m connlimit \
         --connlimit-above 10 --connlimit-mask 32 \
         -j REJECT --reject-with tcp-reset  
  • OK, I formatted the answer for you to make it more readable. But, to make a really good answer, you shall explain why it does work. – grochmal Sep 13 '16 at 14:37
  • Doesn't the mask of 32 limit to a specific IP address so that each IP address can have only 10 simultaneous connections? I'm mostly interested in having a total (any IP address) of 10 simultaneous connections at any given time. Also, it seems that iptables rules might work in general but not when you have a Docker container that the ports are translated into, so I need it to be tested with Docker. – KimHansen Sep 14 '16 at 6:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.