There is no constant relation between the number of e-mail messages (which may be of a very different size each) and the number of packets or bytes transported by a connection, so there is no way to limit by number of messages, only by number of bytes (comparison works up to 4 GB).
Another problem is that you can only count bytes during a single connection which is ephemeral, so if the address would disconnect and re-connect again, the counter would be reset. Vice versa, to drop down an ongoing connection you’d need to have an action=drop src-address-list=spam-blacklist rule before the “accept established” one in your forward chain, because otherwise already established connections would continue even though the remote address would be blacklisted.
Yet another possibility would be to use a script to create a counter rule for each new remote address, which could then count both packets and bytes across the individual connections, but I’m afraid both RAM and flash would protest against such method.
Thank you for informing that.
If i am not mistaken, “connection-state=new” means that take into account only the new connections, not the related or established connections. Right?
The “connection-limit=50,32” means that is a limit of 49 connections from same IP, no?
And finally “limit=50/30s,0:packet” means it’s 49 packets allowed over 30 seconds, if i am not mistaken.
So… All these combined on same rule i guess it will count the 1st packet from a new connection from same IP address. Or i am mistaken? If that is right, what is the difference if it’s the 1st packet of the connection that will send the email, or the email itself? Isn’t the final result the same?
It is not, because decent systems aggregate tasks, so they send more than one message through the same connection, and usually keep TCP connections open for a while after use for the case that something more would need to be transported the same way. It has to do with reuse of client side TCP ports.
Even if you could assume that each message has its own dedicated connection, you’d still have to create an individual rule with nth matcher for each newly encountered remote address, so it would again mean scripting and stress for the flash.