UFW firewall limits for HTTP and HTTPS

ufw_http_https_rules

### Start HTTP ###

# Enter rule
-A ufw-before-input -p tcp --dport 80   -j ufw-http
-A ufw-before-input -p tcp --dport 443  -j ufw-http

# Limit connections per Class C
-A ufw-http -p tcp --syn -m connlimit --connlimit-above 50 --connlimit-mask 24 -j ufw-http-logdrop

# Limit connections per IP
-A ufw-http -m state --state NEW -m recent --name conn_per_ip --set
-A ufw-http -m state --state NEW -m recent --name conn_per_ip --update --seconds 10 --hitcount 20 -j ufw-http-logdrop

# Limit packets per IP -- not working
#-A ufw-http -m recent --name pack_per_ip --set
#-A ufw-http -m recent --name pack_per_ip --update --seconds 1 --hitcount 30 -j ufw-http-logdrop

# DDOS
-A ufw-http -m hashlimit --hashlimit 100/sec --hashlimit-burst 30 --hashlimit-mode srcip --hashlimit-name apache_DDOS --hashlimit-htable-expire 30000 --hashlimit-htable-max 65535 -j ACCEPT
-A ufw-http -j LOG --log-prefix "[UFW DDOS DROP]"
-A ufw-http -j DROP

# Finally accept
-A ufw-http -j ACCEPT

# Log
-A ufw-http-logdrop -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW HTTP DROP] "
-A ufw-http-logdrop -j DROP
### End HTTP ###