Limit connections from one IP with ipfw on FreeBSD

Question

FreeBSD

There is a need to limit the number of simultaneous connections from one IP address. I do it like this:

ipfw add 64999 allow tcp from any to 111.111.111.111 dst-port 80 limit src-addr 30

However, there is a problem here: after a while, the server is no longer available via HTTP. You delete the rule - it immediately works again. Am I doing something wrong?

Answer 1

read aloud what is written and understand what is happening:
a packet from anyone to 111.111.111.111 on port 80 is limited to 30
In LAN, someone else can try to go to the same 111.111.111.111.

Answer 2

Is the server no longer accessible via HTTP to everyone or just to you?
Perhaps, for some reason, connections in the TIME_WAIT state hang for a long time. What does netstat -p tcp
show ?

Answer 3

64999 allow tcp from any to me dst-port 80 setup limit src-addr 30
And if so?