1Allows you to restrict the number of parallel connections to a server per 2client IP address (or client address block). 3.TP 4\fB\-\-connlimit\-upto\fP \fIn\fP 5Match if the number of existing connections is below or equal \fIn\fP. 6.TP 7\fB\-\-connlimit\-above\fP \fIn\fP 8Match if the number of existing connections is above \fIn\fP. 9.TP 10\fB\-\-connlimit\-mask\fP \fIprefix_length\fP 11Group hosts using the prefix length. For IPv4, this must be a number between 12(including) 0 and 32. For IPv6, between 0 and 128. If not specified, the 13maximum prefix length for the applicable protocol is used. 14.TP 15\fB\-\-connlimit\-saddr\fP 16Apply the limit onto the source group. This is the default if 17\-\-connlimit\-daddr is not specified. 18.TP 19\fB\-\-connlimit\-daddr\fP 20Apply the limit onto the destination group. 21.PP 22Examples: 23.IP \(bu 4 24allow 2 telnet connections per client host: 25.br 26iptables \-A INPUT \-p tcp \-\-syn \-\-dport 23 \-m connlimit \-\-connlimit\-above 2 \-j REJECT 27.IP \(bu 4 28you can also match the other way around: 29.br 30iptables \-A INPUT \-p tcp \-\-syn \-\-dport 23 \-m connlimit \-\-connlimit\-upto 2 \-j ACCEPT 31.IP \(bu 4 32limit the number of parallel HTTP requests to 16 per class C sized \ 33source network (24 bit netmask): 34.br 35iptables \-p tcp \-\-syn \-\-dport 80 \-m connlimit \-\-connlimit\-above 16 36\-\-connlimit\-mask 24 \-j REJECT 37.IP \(bu 4 38limit the number of parallel HTTP requests to 16 for the link local network 39(IPv6): 40.br 41ip6tables \-p tcp \-\-syn \-\-dport 80 \-s fe80::/64 \-m connlimit \-\-connlimit\-above 4216 \-\-connlimit\-mask 64 \-j REJECT 43.IP \(bu 4 44Limit the number of connections to a particular host: 45.br 46ip6tables \-p tcp \-\-syn \-\-dport 49152:65535 \-d 2001:db8::1 \-m connlimit 47\-\-connlimit\-above 100 \-j REJECT 48