Bug 118888 - iptables has connlimit code but kernel does not
iptables has connlimit code but kernel does not
Status: CLOSED WONTFIX
Product: Fedora
Classification: Fedora
Component: iptables (Show other bugs)
rawhide
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Thomas Woerner
Ben Levenson
:
: Zen 146390 (view as bug list)
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2004-03-22 07:56 EST by Nik Conwell
Modified: 2007-11-30 17:10 EST (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2004-04-06 06:42:48 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Nik Conwell 2004-03-22 07:56:15 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6)
Gecko/20040207 Firefox/0.8

Description of problem:
iptables has the code for setting connlimit (used to be called
iplimit), but apparently there's no corresponding kernel support (module).

# iptables -I INPUT -p tcp --syn --dport 25 -j DROP -m connlimit
-connlimit-above 3
iptables: No chain/target/match by that name


Also on rh9 2.4.20-30.9:

iptables -I INPUT -p tcp --syn --dport 25 -j DROP -m iplimit
--iplimit-above 3
iptables: No chain/target/match by that name

Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1. iptables -I INPUT -p tcp --syn --dport 25 -j DROP -m connlimit
-connlimit-above 3


Actual Results:  iptables: No chain/target/match by that name

Additional info:
Comment 1 Thomas Woerner 2004-04-06 06:42:48 EDT
I am sorry, but ipt_connlimit is not in the kernel tree; it is only
available in netfilter-pom. 

There is support for some extensions in iptables, which are not yet
available in the kernel. This is done for usability in the future.

Closing as WONTFIX.
Comment 2 Matthew Miller 2004-04-06 09:42:41 EDT
Could this be rephrased as a request to please make that future soon,
and reopened as an RFE?
Comment 3 Thomas Woerner 2004-04-06 11:02:46 EDT
As soon as ipt_connlimit is desired stable by the netfiler developers
and is moved from pom to netfilter-core, you will have the chance to
get it supported.
Comment 4 Matthew Miller 2004-04-06 23:15:24 EDT
Okay, fair enough. :)
Comment 5 Thomas Woerner 2004-06-29 04:57:33 EDT
*** Bug 126916 has been marked as a duplicate of this bug. ***
Comment 6 Jens Hardings Perl 2005-02-04 11:24:30 EST
*** Bug 146390 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.