Is it possible to limit the maximum duration of a TCP connection with iptables
?
With iptables
I can limit the number of concurrent TCP connections per IP address, by using -m connlimit
, and I can also limit the number of new connections per IP address per time interval, by using -m hashlimit
. I'm currently using these rules to get the desired effect:
iptables -A INPUT -m tcp -p tcp --syn --dport 80 -m connlimit --connlimit-above 10 -j DROP
iptables -A INPUT -m tcp -p tcp --dport 80 -m state --state NEW -m hashlimit --hashlimit-above 15/min --hashlimit-burst 10 --hashlimit-mode srcip --hashlimit-name rtlimit -j DROP
However, is there a way to ensure that an "established" TCP connection will be closed after at most n
seconds, in order to prevent "long-standing" connections? (regardless of still "active" or not)
I see people suggest:
iptables -A INPUT -p tcp --dport 80 -m state --state RELATED,ESTABLISHED -m limit --limit 1/minute -j DROP
However, I don't think this really does what I want. To my understanding, above rule would drop all packets that are belonging to an "established" connection and that are coming in at a rate "faster" than one packet per minute. It doesn't close a connection after 1 minute elapsed, or does it?
Is there any way to actually accomplish this with iptables
?