iptables condition 妙用

conn_num=$(cat /proc/sys/net/ipv4/ip_conntrack_count)
if [ $conn_num -ge 80 ]
then
echo 1 >/proc/net/ipt_condition/conn1
else
echo 0 >/proc/net/ipt_condition/conn1
fi

iptables -t mangle -N CONDITION_LMT
iptables -t mangle -I FORWARD -m condition --condition conn1 -i br0 -m state --state NEW -j CONDITION_LMT
iptables -t mangle -A CONDITION_LMT -p udp --dport 53 -j RETURN
iptables -t mangle -A CONDITION_LMT -p tcp --dport 80 -j RETURN
iptables -t mangle -A CONDITION_LMT -p tcp -m connlimit --connlimit-above 50 -j DROP
iptables -t mangle -A CONDITION_LMT -p ! tcp -m connlimit --connlimit-above 80 -j DROP