Iptables and rate limiting per ip address

Iptables and rate limiting per ip address

[Brendan S (Scratch User)]

Hi  

I am an iptables beginner. I want to set up my firewall to rate limit incoming packets based on a particular source IP address (but not any other IP).

I understand that there are dstlimit and hashlimit options for iptables.  It is not clear to me whether these apply the same limit (x packets/sec) to each ip address (ie all IP addresses limited at x packets/sec) or whether their action can be applied to a single address (I suspect the former).

If it is the latter, can the hashlimit switch be limited by (eg) -s?   Alternatively can I jump past the rule for other ip addresses?

Would either of these work?
...
-A src_limit -s !<limit_ip> -j ACCEPT
-A src_limit -m hashlimit --hashlimit 2/min --hashlimit-burst 10 --hashlimit-mode srcip,dstport --hashlimit-name per_src --hashlimit-htable-gcinterval 60000 --hashlimit-htable-expire 300000 -j ACCEPT

...
or

-A src_limit -s <limit_ip> -m hashlimit --hashlimit 2/min --hashlimit-burst 10 --hashlimit-mode srcip,dstport --hashlimit-name per_src --hashlimit-htable-gcinterval 60000 --hashlimit-htable-expire 300000 -j ACCEPT

Thanks


Brendan

Re: Iptables and rate limiting per ip address

[Gáspár Lajos]

Brendan S (Scratch User) írta:
> Hi  
>
> I am an iptables beginner. I want to set up my firewall to rate limit incoming packets based on a particular source IP address (but not any other IP).
>
> I understand that there are dstlimit and hashlimit options for iptables.  It is not clear to me whether these apply the same limit (x packets/sec) to each ip address (ie all IP addresses limited at x packets/sec) or whether their action can be applied to a single address (I suspect the former).
>
> If it is the latter, can the hashlimit switch be limited by (eg) -s?   Alternatively can I jump past the rule for other ip addresses?
>
>   
You can use -s switch
> Would either of these work?
> ...
> -A src_limit -s !<limit_ip> -j ACCEPT
> -A src_limit -m hashlimit --hashlimit 2/min --hashlimit-burst 10 --hashlimit-mode srcip,dstport --hashlimit-name per_src --hashlimit-htable-gcinterval 60000 --hashlimit-htable-expire 300000 -j ACCEPT
>
>   
1. Accept EVERYTHING from EVERYONE except <limit_ip>
2. Accept EVERYTHING ELSE (from <limit_ip>) if hashlimit module permits

> ...
> or
>
> -A src_limit -s <limit_ip> -m hashlimit --hashlimit 2/min --hashlimit-burst 10 --hashlimit-mode srcip,dstport --hashlimit-name per_src --hashlimit-htable-gcinterval 60000 --hashlimit-htable-expire 300000 -j ACCEPT
>
>   
1. Accept from <limit_ip> if haslimit module permits
> Thanks
>
>
> Brendan
>
>   
Do not forget the DROP policy in the chain...

Swifty