To configure connection limits on your VPS server, you can use IPtables rules. In this article, we will look at the most common limitations you can use to limit unwanted traffic and protect the server.
ICMP packet limiting:
/sbin/iptables -A INPUT -p icmp -m limit --limit $pps_icmp/sec --limit-burst 500 -j ACCEPT
/sbin/iptables -A INPUT -p icmp -j DROP
Note: In the $pps_icmp command, replace the value with the desired one.
An ICMP packet is a network packet that uses the Internet Control Message Protocol (ICMP). Unlike TCP or UDP, ICMP is not used to transfer application data. Instead, it is used for network diagnostics, error reporting, and status messages between devices.
UDP packet limiting:
/sbin/iptables -A INPUT -p udp -m limit --limit $pps_udp/sec --limit-burst 500 -j ACCEPT
/sbin/iptables -A INPUT -p udp -j DROP
Note: Replace $pps_udp with the desired value.
A UDP packet is a network packet that uses the User Datagram Protocol (UDP) to send data between devices.
Limit parallel connections from a single IP address:
/sbin/iptables -A INPUT -m connlimit --connlimit-above $connlimit --connlimit-mask 32 -j DROP
/sbin/iptables -A INPUT -m connlimit --connlimit-above $connlimit --connlimit-mask 8 -j DROP
Note: Replace $connlimit with the desired value.
TCP SYN packet limiting:
/sbin/iptables -A INPUT -p tcp -m recent --name $name --set
/sbin/iptables -A INPUT -p tcp -m recent --name $name --update --seconds 1 --hitcount $pps_syn -j DROP
Note: Replace $pps_syn with the desired value, and replace $name with the desired rule name.
A TCP SYN packet is the first packet sent to start a TCP connection between a client and a server.
Incoming connection traffic limitation:
/sbin/iptables -A INPUT -m limit --limit $pps/sec --limit-burst 5000 -j ACCEPT
Note: Replace $pps with the desired value.