{"action":"created","issue":{"url":"https://api.github.com/repos/firewalld/firewalld/issues/70","repository_url":"https://api.github.com/repos/firewalld/firewalld","labels_url":"https://api.github.com/repos/firewalld/firewalld/issues/70/labels{/name}","comments_url":"https://api.github.com/repos/firewalld/firewalld/issues/70/comments","events_url":"https://api.github.com/repos/firewalld/firewalld/issues/70/events","html_url":"https://github.com/firewalld/firewalld/issues/70","id":128190259,"node_id":"MDU6SXNzdWUxMjgxOTAyNTk=","number":70,"title":"Add support to per-source-IP rate limiting","user":{"login":"da2x","id":1102886,"node_id":"MDQ6VXNlcjExMDI4ODY=","avatar_url":"https://avatars2.githubusercontent.com/u/1102886?v=4","gravatar_id":"","url":"https://api.github.com/users/da2x","html_url":"https://github.com/da2x","followers_url":"https://api.github.com/users/da2x/followers","following_url":"https://api.github.com/users/da2x/following{/other_user}","gists_url":"https://api.github.com/users/da2x/gists{/gist_id}","starred_url":"https://api.github.com/users/da2x/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/da2x/subscriptions","organizations_url":"https://api.github.com/users/da2x/orgs","repos_url":"https://api.github.com/users/da2x/repos","events_url":"https://api.github.com/users/da2x/events{/privacy}","received_events_url":"https://api.github.com/users/da2x/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/firewalld/firewalld/milestones/10","html_url":"https://github.com/firewalld/firewalld/milestone/10","labels_url":"https://api.github.com/repos/firewalld/firewalld/milestones/10/labels","id":2094816,"node_id":"MDk6TWlsZXN0b25lMjA5NDgxNg==","number":10,"title":"0.4.5","description":"","creator":{"login":"t-woerner","id":6049493,"node_id":"MDQ6VXNlcjYwNDk0OTM=","avatar_url":"https://avatars0.githubusercontent.com/u/6049493?v=4","gravatar_id":"","url":"https://api.github.com/users/t-woerner","html_url":"https://github.com/t-woerner","followers_url":"https://api.github.com/users/t-woerner/followers","following_url":"https://api.github.com/users/t-woerner/following{/other_user}","gists_url":"https://api.github.com/users/t-woerner/gists{/gist_id}","starred_url":"https://api.github.com/users/t-woerner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/t-woerner/subscriptions","organizations_url":"https://api.github.com/users/t-woerner/orgs","repos_url":"https://api.github.com/users/t-woerner/repos","events_url":"https://api.github.com/users/t-woerner/events{/privacy}","received_events_url":"https://api.github.com/users/t-woerner/received_events","type":"User","site_admin":false},"open_issues":5,"closed_issues":0,"state":"open","created_at":"2016-10-26T13:11:03Z","updated_at":"2016-10-26T13:15:16Z","due_on":null,"closed_at":null},"comments":0,"created_at":"2016-01-22T16:19:01Z","updated_at":"2018-06-01T20:06:05Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"`ufw limit ssh` will limit connections per-source IP to 6 per 30 seconds (non-configurable). After exceeding this limit, new connections from that IP would be rejected. A configurable version of this for `firewall-cmd` would be very useful. The rich-language variant can current only be used to limit the total number of connections, something which would easily lock legitimate users out of the system.\n\nThe work-around that is circulating around on forums are all variants of [this one](http://serverfault.com/a/683752/83257):\n\n```\nfirewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 -p tcp --dport 22 \\\n    -m state --state NEW -m recent --set\nfirewall-cmd --direct --add-rule ipv6 filter INPUT_direct 0 -p tcp --dport 22 \\\n     -m state --state NEW -m recent --set\nfirewall-cmd --direct --add-rule ipv4 filter INPUT_direct 1 -p tcp --dport 22 \\\n     -m state --state NEW -m recent --update --seconds 30 --hitcount 6 \\\n     -j REJECT --reject-with tcp-reset\nfirewall-cmd --direct --add-rule ipv6 filter INPUT_direct 1 -p tcp --dport 22 \\\n     -m state --state NEW -m recent --update --seconds 30 --hitcount 6 \\\n     -j REJECT --reject-with tcp-reset\n```\n\nSuggested syntax:\n\n```\nfirewall-cmd --add-service ssh --limit 6/30m\nfirewall-cmd --add-service http --limit 64/1m\n```\n\nAlthough expanding what is available in the rich language (and improving documentation) may be the way to go. Could be confusing to have two different meanings of “limit”.\n"},"comment":{"url":"https://api.github.com/repos/firewalld/firewalld/issues/comments/393994834","html_url":"https://github.com/firewalld/firewalld/issues/70#issuecomment-393994834","issue_url":"https://api.github.com/repos/firewalld/firewalld/issues/70","id":393994834,"node_id":"MDEyOklzc3VlQ29tbWVudDM5Mzk5NDgzNA==","user":{"login":"erig0","id":313253,"node_id":"MDQ6VXNlcjMxMzI1Mw==","avatar_url":"https://avatars2.githubusercontent.com/u/313253?v=4","gravatar_id":"","url":"https://api.github.com/users/erig0","html_url":"https://github.com/erig0","followers_url":"https://api.github.com/users/erig0/followers","following_url":"https://api.github.com/users/erig0/following{/other_user}","gists_url":"https://api.github.com/users/erig0/gists{/gist_id}","starred_url":"https://api.github.com/users/erig0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erig0/subscriptions","organizations_url":"https://api.github.com/users/erig0/orgs","repos_url":"https://api.github.com/users/erig0/repos","events_url":"https://api.github.com/users/erig0/events{/privacy}","received_events_url":"https://api.github.com/users/erig0/received_events","type":"User","site_admin":false},"created_at":"2018-06-01T20:06:05Z","updated_at":"2018-06-01T20:06:05Z","author_association":"COLLABORATOR","body":"@da2x, sounds like you want the equivalent of iptables hashlimit. Is that correct?"}}
{"actor":{"display_login":"erig0"}}