Bug 118888 - iptables has connlimit code but kernel does not
Summary: iptables has connlimit code but kernel does not
Status: CLOSED WONTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: iptables   
(Show other bugs)
Version: rawhide
Hardware: i386
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Thomas Woerner
QA Contact: Ben Levenson
URL:
Whiteboard:
Keywords:
: Zen 146390 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2004-03-22 12:56 UTC by Nik Conwell
Modified: 2007-11-30 22:10 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2004-04-06 10:42:48 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

Description Nik Conwell 2004-03-22 12:56:15 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6)
Gecko/20040207 Firefox/0.8

Description of problem:
iptables has the code for setting connlimit (used to be called
iplimit), but apparently there's no corresponding kernel support (module).

# iptables -I INPUT -p tcp --syn --dport 25 -j DROP -m connlimit
-connlimit-above 3
iptables: No chain/target/match by that name


Also on rh9 2.4.20-30.9:

iptables -I INPUT -p tcp --syn --dport 25 -j DROP -m iplimit
--iplimit-above 3
iptables: No chain/target/match by that name

Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1. iptables -I INPUT -p tcp --syn --dport 25 -j DROP -m connlimit
-connlimit-above 3


Actual Results:  iptables: No chain/target/match by that name

Additional info:

Comment 1 Thomas Woerner 2004-04-06 10:42:48 UTC
I am sorry, but ipt_connlimit is not in the kernel tree; it is only
available in netfilter-pom. 

There is support for some extensions in iptables, which are not yet
available in the kernel. This is done for usability in the future.

Closing as WONTFIX.


Comment 2 Matthew Miller 2004-04-06 13:42:41 UTC
Could this be rephrased as a request to please make that future soon,
and reopened as an RFE?

Comment 3 Thomas Woerner 2004-04-06 15:02:46 UTC
As soon as ipt_connlimit is desired stable by the netfiler developers
and is moved from pom to netfilter-core, you will have the chance to
get it supported.


Comment 4 Matthew Miller 2004-04-07 03:15:24 UTC
Okay, fair enough. :)

Comment 5 Thomas Woerner 2004-06-29 08:57:33 UTC
*** Bug 126916 has been marked as a duplicate of this bug. ***

Comment 6 Jens Hardings Perl 2005-02-04 16:24:30 UTC
*** Bug 146390 has been marked as a duplicate of this bug. ***


Note You need to log in before you can comment on or make changes to this bug.