From dd8965ec3ab70bf9a961d21f301d8fcd81f9733e Mon Sep 17 00:00:00 2001 From: Stephen Gran Date: Sat, 6 Mar 2010 13:23:13 +0000 Subject: [PATCH] first stab at http limit rules - how bad can it go? Signed-off-by: Stephen Gran --- modules/apache2/manifests/init.pp | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/modules/apache2/manifests/init.pp b/modules/apache2/manifests/init.pp index 6235ed3a2..8b6ba0b05 100644 --- a/modules/apache2/manifests/init.pp +++ b/modules/apache2/manifests/init.pp @@ -129,8 +129,34 @@ class apache2 { command => "/etc/init.d/apache2 force-reload", refreshonly => true, } - @ferm::rule { "dsa-apache": - domain => "(ip ip6)", + @ferm::rule { "dsa-http-limit": + prio => "20", + description => "limit HTTP DOS", + rule => "@subchain 'http_limit' mod limit limit-burst 60 limit 15/minute jump ACCEPT; jump DROP;" + } + @ferm::rule { "dsa-http-soso": + prio => "21", + description => "slow yahoo spider", + rule => "@subchain 'limit_sosospider' mod connlimit connlimit-above 2 connlimit-mask 21 jump DROP; jump http_limit" + } + @ferm::rule { "dsa-http-yahoo": + prio => "21", + description => "slow yahoo spider", + rule => "@subchain 'limit_yahoo' mod connlimit connlimit-above 2 connlimit-mask 16 jump DROP; jump http_limit" + } + @ferm::rule { "dsa-http-rules": + prio => "22", + description => "http subchain", + rule => "@subchain 'http' saddr ( 74.6.22.182 74.6.18.240 ) jump limit_yahoo; saddr 124.115.0.0/21 jump limit_sosospider; mod recent name HTTPDOS update seconds 1800 jump log_or_drop; mod hashlimit hashlimit-name HTTPDOS hashlimit-mode srcip hashlimit-burst 600 hashlimit 30/minute jump ACCEPT; mod recent name HTTPDOS set jump log_or_drop;" + } + @ferm::rule { "dsa-http": + prio => "23", + description => "Allow web access", + rule => "proto tcp dport http jump http;" + } + @ferm::rule { "dsa-http-v6": + domain => "(ip6)", + prio => "23", description => "Allow web access", rule => "&SERVICE(tcp, 80)" } -- 2.20.1