Apache - Limit max number of simultaneous connections from an external IP?

Solution 1:

I believe that mod_qos is probably going to be the answer to your prayers. I can't provide any specific configuration or recommendations, because I've never actually used it, but it comes with all the knobs you're likely to need.

More generally, iptables is more than capable of handling this sort of thing itself, and it's a far better solution (do networky stuff at the networky level). This is especially true if you want to deal with other protocols as well as HTTP, or only want to apply the limits to a subset of connections.

The iptables command you want is something like

iptables -I INPUT -p tcp --dport 80 -m state --state NEW -m recent --name http --update --seconds 1 --hitcount 5 -j REJECT
iptables -I INPUT -p tcp --dport 80 -m state --state NEW -m recent --name http --set

This will limit incoming connections to 5 per second.

Note, however, that connection limiting can be a real pain for legitimate users who just happen to be heavy users of the site, and it'll only slow down attackers that really aren't a concern anyway. Use with caution.