iptables 的limit模块

Limit模块的功能是限制单位时间内进入数据包的数量。

Limit的工作原理及令牌桶算法朱双印大佬介绍的生动明晰,此地不再赘述,只用实例进一步加深Limit模块的理解。

iptables -t filter -R INPUT 1 -p icmp -m limit --limit 10/minute --limit-burst 5 -j ACCEPT

--limit 10/minute表示一分钟产生10个令牌即6秒一个,--limit-burst 5表示令牌桶最多可以放5个令牌,此项默认值就是5。Ping本机的响应信息如下:

64 bytes from 192.168.80.133: icmp_seq=0 ttl=64 time=21.3 ms

64 bytes from 192.168.80.133: icmp_seq=1 ttl=64 time=0.564 ms

64 bytes from 192.168.80.133: icmp_seq=2 ttl=64 time=0.559 ms

64 bytes from 192.168.80.133: icmp_seq=3 ttl=64 time=0.478 ms

64 bytes from 192.168.80.133: icmp_seq=4 ttl=64 time=0.488 ms

From 192.168.80.133 icmp_seq=5 Destination Port Unreachable

64 bytes from 192.168.80.133: icmp_seq=6 ttl=64 time=0.096 ms

From 192.168.80.133 icmp_seq=7 Destination Port Unreachable

From 192.168.80.133 icmp_seq=8 Destination Port Unreachable

From 192.168.80.133 icmp_seq=9 Destination Port Unreachable

From 192.168.80.133 icmp_seq=10 Destination Port Unreachable

From 192.168.80.133 icmp_seq=11 Destination Port Unreachable

64 bytes from 192.168.80.133: icmp_seq=12 ttl=64 time=0.710 ms

From 192.168.80.133 icmp_seq=13 Destination Port Unreachable

From 192.168.80.133 icmp_seq=14 Destination Port Unreachable

From 192.168.80.133 icmp_seq=15 Destination Port Unreachable

From 192.168.80.133 icmp_seq=16 Destination Port Unreachable

From 192.168.80.133 icmp_seq=17 Destination Port Unreachable

64 bytes from 192.168.80.133: icmp_seq=18 ttl=64 time=1.22 ms

因为--limit-burst 是5,所以前5个包顺利拿到令牌进入本机,第6个ping包到来时令牌桶空了,直接被拒绝。此时6秒时间已到,系统便生成一个令牌并放入桶中,此时第7个请求包到达,拿到令牌后进入本机ping成功了。第8,9,10,11,12个ping包请求时,令牌桶空,这5个包直接被拒绝。当到达6秒时又产生一个令牌,这时正好第13个ping包请求,便成功了。以后便如此反复。

把ping的间隔调到2秒,ping -i 2 192.168.80.133

64 bytes from 192.168.80.133: icmp_seq=0 ttl=64 time=51.5 ms

64 bytes from 192.168.80.133: icmp_seq=1 ttl=64 time=0.852 ms

64 bytes from 192.168.80.133: icmp_seq=2 ttl=64 time=0.630 ms

64 bytes from 192.168.80.133: icmp_seq=3 ttl=64 time=0.383 ms

64 bytes from 192.168.80.133: icmp_seq=4 ttl=64 time=0.612 ms

64 bytes from 192.168.80.133: icmp_seq=5 ttl=64 time=0.497 ms

From 192.168.80.133 icmp_seq=6 Destination Port Unreachable

64 bytes from 192.168.80.133: icmp_seq=7 ttl=64 time=1.35 ms

From 192.168.80.133 icmp_seq=8 Destination Port Unreachable

From 192.168.80.133 icmp_seq=9 Destination Port Unreachable

64 bytes from 192.168.80.133: icmp_seq=10 ttl=64 time=0.110 ms

From 192.168.80.133 icmp_seq=11 Destination Port Unreachable

From 192.168.80.133 icmp_seq=12 Destination Port Unreachable

64 bytes from 192.168.80.133: icmp_seq=13 ttl=64 time=0.567 ms

刚开始令牌桶中有5个令牌,所以前5个包可以顺利ping通,于此同时系统时间过了10秒,期间系统产生了第1个令牌,第6个包也可以ping通。第7个ping包到达时还没产生第2个令牌,icmp_seq=6包被拒绝。以后便如此反复。

把ping的间隔调到3秒,4秒,5秒等,又会如何?

--limit 10/minute的值调大或调小,又会出现什么情况,只有不断尝试不断探索才能不断进步。

标签:Iptables 发布于:2019-10-19 12:51:47