Cfxtrjtrk

I'm using these rules in /etc/ufw/before.rules

# Limit to 20 concurrent connections on port 80 per IP

-A ufw-before-input -p tcp --syn --dport 80 -m connlimit --connlimit-above 20 -j DROP

-A ufw-before-input -p tcp --syn --dport 443 -m connlimit --connlimit-above 20 -j DROP



# Limit to 20 connections on port 80 per 2 seconds per IP

-A ufw-before-input -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set

-A ufw-before-input -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --update --seconds 2 --hitcount 20 -j DROP

-A ufw-before-input -p tcp --dport 443 -i eth0 -m state --state NEW -m recent --set

-A ufw-before-input -p tcp --dport 443 -i eth0 -m state --state NEW -m recent --update --seconds 2 --hitcount 20 -j DROP

I want to add a rule that will force the local system ips to not be connection or rate limited at all. For example, I have many cron jobs that connect to the server within the server. I need to prevent these from failing when too many are running at once.

UPDATE WITH SOLUTION: I think I just had to add more rules in before.rules instead of ufw command line to override the connection limit for specific ips. I can't answer my own question yet.

I just adds these rules above the connlimit rules:

-A ufw-before-input -p tcp --dport 80 -s 127.0.0.1 -j ACCEPT

-A ufw-before-input -p tcp --dport 443 -s 127.0.0.1 -j ACCEPT

I found another solution using iptables.

iptables command to limit connections:

iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 20 -j DROP

you can exclude one ip:

iptables -A INPUT -p tcp --syn --dport 80 -d ! 127.0.0.1 -m connlimit --connlimit-above 20 -j DROP

I hope this is helpful for you.

First , you have not provided sufficeint information for us to give you a specific answer.

Second, those are ufw rules. ufw is a front end for iptables and you can manage the rules from the command line, ufw or a graphical interface, gufw.

Using iptables directly will conflict with your ufw rules, so use one tool or another.

You need to post your ufw rules. In general you are going to allow your local network prior to the rules you posted. How are you managing your ufw rules? command line? gufw?

for ufw, something like this

sudo ufw allow from 192.168.0.0/24

See also:

http://blog.bodhizazen.com/linux/firewall-ubuntu-servers/

https://help.ubuntu.com/community/UFW

and for iptables http://bodhizazen.com/Tutorials/iptables