This should do it:
iptables -A INPUT -p tcp -m multiport --dport 80,443 -m state --state NEW -m limit
--limit 100/minute --limit-burst 300 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dport 80,443 -m state --state NEW -m limit --limit
100/minute --limit-burst 300 -j LOG --log-level info --log-prefix NEW-HTTP-DROP:
iptables -A INPUT -p tcp -m multiport --dport 80,443 -m state --state RELATED,ESTABLISHED -m
limit --limit 100/second --limit-burst 100 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dport 80,443 -m state --state RELATED,ESTABLISHED -m
limit --limit 100/second --limit-burst 100 -j LOG --log-level info --log-prefix
EST-HTTP-DROP:
iptables -A INPUT -p tcp -m multiport --dport 80,443 -j DROP
iptables -A OUTPUT -p tcp -m multiport --sport 80,443 -j ACCEPT
|
