I'm hosting several websites, and some of them use scripts to ddos externals servers from my server. There is a possibility to control the outgoing traffic by, for example, limiting the number of request per second or so ?

share|improve this question
up vote 1 down vote accepted

Here are some example to prevent DOS, you can man iptables to search the keyword 'limit, connlimit, hitcount' for more informations.

Allow 5 new connection packets per second

iptables -A OUTPUT -p tcp --syn -m limit --limit 1/s --limit-burst 5 -j ACCEPT

Allow 30 connections during 60 seconds each IP.

iptables -A OUTPUT -p tcp --dport 80 -m recent --name BAD_HTTP_ACCESS --update --seconds 60 --hitcount 30 -j REJECT

50 max connections per IP to httpd

iptables -A OUTPUT -p tcp --dport 80 -m connlimit --connlimit-above 50 -j REJECT
share|improve this answer
    
So this will stop say, an application on my server, spamming other servers with bad packets? – Joehot200 Jun 3 '15 at 22:43
    
No, it's a limitation for output traffic, prevent too much response to other clients. If you want to block bad packets, you have to define rules in 'INPUT' table instead of 'OUTPUT' . – Brightshine Jun 4 '15 at 4:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.