1

A connection is a 5 tuple (ip src/dst, port src/dst, protocol).
What about different connections between ipv4 and ipv6?

If I define the iptables rule:

iptables -A INPUT -p tcp -m connlimit --connlimit-above 50 -j REJECT --reject-with tcp-reset

It limits the tcp connections to 50.

What about ipv6 tcp connections? should I write also

ip6tables -A INPUT -p tcp -m connlimit --connlimit-above 50 -j REJECT --reject-with tcp-reset

?

Does it mean that I can have 100 tcp connections overall? (50 ipv4 50 ipv6) ?

How does it work? Thanks.

3

You will have 50 of each connections, since iptables will handle only ipv4 and ip6tables will deal with ipv6 connections. They will not "sum" up, because they are managed by different tools on each protocol version.

Will nftables, the "new firewall" be able to deal with both protocols summing up everything? No. You will have the "same tool"(nft binary) to deal with protocols independently using the rule keyword: nft add rule ip6 ... and nft add rule ip ...

As pointed out in the comments, the nft_connlimit extension was recently added to Linux 4.18, allowing you to count sum ipv4 and ipv6 if you use the reserved word inet while creating rules.

Related Stuff:

  • 1
    Now the feature has been implemented with nftables, actually using the family inet instead of just ip or just ip6 will use the combined count of IPv4 and IPv6 connections retrieved from conntrack. See my related answer on SF there: How do you set a max connection limit with nftables? – A.B Nov 13 '18 at 23:59
  • Thanks for the info A.B. Added to the answer :) – user34720 Nov 14 '18 at 9:59
1

Yes, that means you can have 50+50 connections.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.