Demo
Demo

Knowledge base

PMTA knowledge base›Block Global›Directive§ 3.3.1.60.2

ip-connection-limit

Global

A limit on simultaneous connections to a receiver's address range
in the configuration this is a lineip-connection-limitinside the block Global
The same limit, but by address

The line limits the number of simultaneous connections to an MX whose address falls within the named range. The range is written in CIDR notation — 173.194/16 — or as a single address.

The manual says: the syntax is similar to the neighboring mx-connection-limit, only with addresses instead of names. So all its caveats apply too: the limit is counted for each sending address separately and applied to each matching MX, not to all of them together.

It is specifically noted that the directive is allowed only at the node level. It cannot be written inside blocks.

The line is repeated — one line per rule.

The main trap is that receivers change addresses more often than names. A major receiver’s MX name lives for years, while the addresses behind it change: sites are added, old ones are rotated out. A range rule that is correct today may match nothing tomorrow — and the limit will stop working silently.

Hence the practical point: limit by address when names do not work — for example, when the same address serves MXs with different names. In other cases a name is more reliable.

The other half is shared with the neighboring line: the limit is multiplied by the number of sending addresses.

What the Hub does. It does not write it: it sets connection limits where the receiver counts them — in recipient rules and on sending addresses.

The Hub also cannot track receivers’ address changes, so a range rule would have to be maintained by hand.

Recommended values

What to set. Limiting by address is for a narrow case:

Value When
do not write it the usual case: limits are set on recipients and sending addresses
a range and a number the same address serves MXs with different names, and it is exactly that address that needs limiting
a single address a pinpoint measure for a specific receiver host

As with the neighboring line, count it multiplied by the number of sending addresses.

The syntax, selection by address, the node-level-only restriction and the similarity to the MX name limit come from the manual, § 3.3.1.60.2. The caveats about counting per sending address come from the same place, § 3.3.1.60.1. The breakdown of cases is ours.
Example configuration
# a whole range and a pinpoint rule for one address
ip-connection-limit 173.194/16 50ip-connection-limit 104.47.2.33 1
The limit is counted for each sending address separately and applied to each matching MX. Both numbers are multiplied by the number of your sending addresses.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends2 mistakes▶

Setting a range and not keeping it up to date

our experience

What it costsReceivers change addresses more often than names. The rule stops matching, and the limit disappears silently — with no error and no warning.
How to spot itThe number of connections to the receiver has grown, although the configuration has not changed.
How to do it rightCheck the addresses with name resolution during investigations — or limit by MX names.

Writing the line inside a block

§ 3.3.1.60.2

What it costsThe directive is allowed only at the node level. Inside a block it does not take effect, and the configuration may fail to apply entirely.
How to spot itThe line sits inside a recipient block or a sending stream.
How to do it rightMove it to the root of the configuration file.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
ip-connection-limit CIDR N
Values
a range in CIDR notation and an integer number of connections; the line can be repeated
Applying
reload, no restart needed
Queue
will not touch what is already queued
Where to write it
Global
How many times
may be repeated
Everything here comes from the manual, with the section.
Inheritance
The directive is allowed only at the node level — it cannot be written inside blocks, and the manual says so directly. At the same time the limit is counted for each sending address separately: one line gives as many limits as the node has addresses.
⇄

Related directives

1 relation

Same name in other blocks

mx-connection-limitGlobalThe same limit by MX names; all its caveats about counting per sending address apply here too. § 3.3.1.60.2

How to check on the node
The rules are visible in the configuration; whether they match is checked with name resolution:
grep -n 'ip-connection-limit' /etc/pmta/config
pmta resolve gmail.com
The second command shows which addresses the receiver’s MXs have now. If they have moved outside the rule’s range, the limit does not apply — and nobody will report it.
◇

What else to read

3 articles

◇Four value types the whole config is written inBoolean, domain pattern, regular expression and time interval — defined once in § 3.2 and then used by all directives.◇How the policy for a receiver is assembledSettings are assembled from the most general pattern to the most precise; the order of blocks in the file means nothing.◇Backoff mode — the queue's second personalityA queue that a receiver has started refusing switches to a parallel set of limits, retries and routes — ten directives that act only in this mode.

In the Hub
Cost of a mistake
reversible: harms only while it is set
Scenarios
Tune the pace for a provider
Neighboring settings of the block Global:total-max-smtp-outmax-memory-usage-percentmx-connection-limitsmtp-proxy-source-hostdomain-keyAll 108 directives of the block →