@ferm::rule { 'dsa-snapshot-connlimit':
domain => '(ip ip6)',
prio => "005",
- rule => "proto tcp mod state state (NEW) daddr (${ipv4addr} ${ipv6addr}) mod multiport destination-ports (80 443) mod connlimit connlimit-above 3 DROP;
- proto tcp mod state state (NEW) dport 6081 mod connlimit connlimit-above 3 DROP
+ rule => "proto tcp mod state state (NEW) interface ! lo daddr (${ipv4addr} ${ipv6addr}) mod multiport destination-ports (80 443) mod connlimit connlimit-above 3 DROP;
+ proto tcp mod state state (NEW) interface ! lo dport 6081 mod connlimit connlimit-above 3 DROP
",
}