💡 Feature: CONNLIMIT for HTTP/3 (443 UDP)

[ShaiMagal]

Control Panel › Name

All

Category

💡 Other

Feature Description

Hi,

actually we have CONNLIMIT option in csf.conf, for example:
CONNLIMIT = "80;100,443;100"

Then we got this iptables rules:

    0     0 CONNLIMIT  tcp  --  !lo    *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 flags:0x17/0x02 #conn src/32 > 100
    0     0 CONNLIMIT  tcp  --  !lo    *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443 flags:0x17/0x02 #conn src/32 > 100

BUT, this is TCP only, so it will not impact HTTP/3 traffic, because it's using 443 UDP.

Is there any idea, how to add something like "CONNLIMIT_UDP", or something like that?

No we must use raw iptables rules (csfpost.sh) for it, for example (didn't tested ,just only for imagination, how it can be workarounded):
iptables -A INPUT ! -i lo -p udp --dport 443 -m connlimit --connlimit-above 100 --connlimit-mask 32 -j CONNLIMIT

But nativelly it will be great.

Screenshots

No response