公安部4號令之2、3點(diǎn)，我打算按帖中方法處理，請大家看看..

beck2000

關(guān)于第二點(diǎn)，對于并發(fā)和連接數(shù)量，我計(jì)劃為iptables增加connlimt模塊.
connlimit, formerly known as iplimit, is another new addition to iptables, and still lacks support in the mainstream kernel. A patch for kernel connlimit support exists in the patch-o-matic set available at netfilter.org.
connlimit allows matches to be made based on the number of connections currently open from a particular host or group of hosts.

Examples:
# allow 2 telnet connections per client host，如果對付的是smtp，則把23改為25
iptables -p tcp --syn --dport 23 -m connlimit --connlimit-above 2 -j REJECT
也算勉強(qiáng)符合要求，因?yàn)閟mtp連接的時(shí)間比較短，如果在某一時(shí)間總共是那么多連進(jìn)來，也算并發(fā)了...

至于第三我還沒找到現(xiàn)成的方式...

spritecat

我感覺好像沒有用，對25 port connlimit 好像不太管用。我的25 port 還是會(huì)被一個(gè)IP占滿。