snapshot: try to put a bound on connections per client

diff --git a/modules/roles/manifests/snapshot_web.pp b/modules/roles/manifests/snapshot_web.pp
index 34d699e..ba6c5d6 100644 (file)
--- a/modules/roles/manifests/snapshot_web.pp
+++ b/modules/roles/manifests/snapshot_web.pp
@@ -55,6 +55,12 @@ class roles::snapshot_web {
                }
        }
 
+       @ferm::rule { 'dsa-snapshot-connlimit':
+               domain => '(ip ip6)',
+               prio  => "005",
+               rule  => "proto tcp mod state state (NEW) daddr (${ipv4addr} ${ipv6addr})  mod multiport destination-ports (80 443 6081) mod connlimit connlimit-above 3 DROP",
+       }
+
        # varnish cache
        ###############
        @ferm::rule { 'dsa-nat-snapshot-varnish-v4':