Limit Maximum TCP Connections to Web Servers

In Windows XP SP2 and Windows Vista, a lot of users have been searching for tcpip.sys patched hack or auto patcher that unlocks the TCP/IP half-open simultaneous connection limit to no upper bound. In a web server that exposes to Internet, the other way round may be true, where there may be a need to limit and restrict maximum number of TCP incoming connections to a web server that are allowed at any one time.

Limiting maximum incoming TCP web connections to the web server is useful to prevent or better still, stop DDoS (Distributed Denial of Service) or DoS (Denial of Service) attacks. DDoS attacks can consume tremendous amount of system resources and CPU load, slow down the web page serving time or response time to the legitimate visitors. And in worse case, the attack can hang and bring down the web server completely, even if you have dual qual-core CPU dedicated server with multiple GBs of memory.

To prevent and response to Denial of Service attacks, other than using firewall or SYN cookies, it’s also possible to limit number of TCP connections that server can accept per second. The concept may applied also when a web page is been digged, stumbled or farked which bring large amount of viewers in short time span. However, this workaround only intend to make the server ’survives’ and not completely brought down by massive amount of connections. And the restriction will apply on valid human visitors to the websites hosted on server too if the limitation hit its bound and actively denies new connections.

Administrator can use iptables to set the maximum limit on number of TCP connections to the server per second acceptable. To configure the limit, login as root to shell and issue the following commands, replacing <n> with the number of connections per second you want to set, and <m> with burst rate which u want the server to start applying the limit, both without brackets.

iptables -t nat -N syn-flood

iptables -t nat -A syn-flood -m limit –limit <n>/s –limit-burst <m> -j RETURN

iptables -t nat -A syn-flood -j DROP

iptables -t nat -A PREROUTING -i $EXT_IFACE -d $DEST_IP -p tcp –syn -j syn-flood

Commands above will limit maximum number of TCP connections that can connect to web server to n connections per second, after m connections have been established. There is not fixed figure to the number of connections you can set. If the server is powerful it’s possible to increase the values to handle and accept more connection in order to reduce any drop connections. Try and set the best values for your server.

Related Articles

• Tweak (Increase or Change) Maximum Simultaneous HTTP and Downloads Connections to Web Server
• Half-Open Outbound TCP Connections Limit Removed in Windows 7 and Vista SP2 (No Patch Required)
• Disable and Remove Half-Open TCP Connections Limit (to Unlimited) in Windows 7 and Vista SP2 with EnableConnectionRateLimitin Registry Key
• Send and Receive Maximum Email Attachment Size Limit of Up To 25 MB in Gmail
• Gmail 20MB Maximum Attachment Size Limit
• Windows Vista 32-bit and 64-bit (x86 and x64) Maximum Supported RAM Physical Memory Limit
• How to Find and Check Number of Connections to a Server
• Windows Half-Open Limit Fix (Patch) Free Download to Remove XP, Vista and Server 2003 (32 and 64-bit) TCP 4226 Connection Attempts Limit
• TCP/IP Has Reached the Security Limit Imposed on the Number of Concurrent TCP Connect Attempts Error on Windows Vista
• How to Enable Concurrent Half-Open TCP Connect Attempts Limit in Windows Server 2008 and Vista SP2 or Windows 7

This entry was posted on Thursday, December 6th, 2007 at 6:37 pm and is filed under Webmaster Resources. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.