Bug 118888

Summary: iptables has connlimit code but kernel does not
Product: [Fedora] Fedora Reporter: Nik Conwell <nik>
Component: iptablesAssignee: Thomas Woerner <twoerner>
Status: CLOSED WONTFIX QA Contact: Ben Levenson <benl>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: alex.mail, jhp, mattdm
Target Milestone: ---   
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2004-04-06 10:42:48 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Nik Conwell 2004-03-22 12:56:15 UTC 
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6)
Gecko/20040207 Firefox/0.8

Description of problem:
iptables has the code for setting connlimit (used to be called
iplimit), but apparently there's no corresponding kernel support (module).

# iptables -I INPUT -p tcp --syn --dport 25 -j DROP -m connlimit
-connlimit-above 3
iptables: No chain/target/match by that name


Also on rh9 2.4.20-30.9:

iptables -I INPUT -p tcp --syn --dport 25 -j DROP -m iplimit
--iplimit-above 3
iptables: No chain/target/match by that name

Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1. iptables -I INPUT -p tcp --syn --dport 25 -j DROP -m connlimit
-connlimit-above 3


Actual Results:  iptables: No chain/target/match by that name

Additional info:
Comment 1 Thomas Woerner 2004-04-06 10:42:48 UTC 
I am sorry, but ipt_connlimit is not in the kernel tree; it is only
available in netfilter-pom. 

There is support for some extensions in iptables, which are not yet
available in the kernel. This is done for usability in the future.

Closing as WONTFIX.
Comment 2 Matthew Miller 2004-04-06 13:42:41 UTC 
Could this be rephrased as a request to please make that future soon,
and reopened as an RFE?
Comment 3 Thomas Woerner 2004-04-06 15:02:46 UTC 
As soon as ipt_connlimit is desired stable by the netfiler developers
and is moved from pom to netfilter-core, you will have the chance to
get it supported.
Comment 4 Matthew Miller 2004-04-07 03:15:24 UTC 
Okay, fair enough. :)
Comment 5 Thomas Woerner 2004-06-29 08:57:33 UTC 
*** Bug 126916 has been marked as a duplicate of this bug. ***
Comment 6 Jens Hardings Perl 2005-02-04 16:24:30 UTC 
*** Bug 146390 has been marked as a duplicate of this bug. ***