Allows you to restrict the number of parallel TCP connections to a
server per client IP address (or address block).
.TP
[\fB!\fR] \fB--connlimit-above \fIn\fR
match if the number of existing tcp connections is (not) above n
.TP
.BI "--connlimit-mask " "bits"
group hosts using mask
.P
Examples:
.TP
# allow 2 telnet connections per client host
iptables -p tcp --syn --dport 23 -m connlimit --connlimit-above 2 -j REJECT
.TP
# you can also match the other way around:
iptables -p tcp --syn --dport 23 -m connlimit ! --connlimit-above 2 -j ACCEPT
.TP
# limit the nr of parallel http requests to 16 per class C sized \
network (24 bit netmask)
iptables -p tcp --syn --dport 80 -m connlimit --connlimit-above 16
--connlimit-mask 24 -j REJECT