Iptables and rate limiting per ip address
Hi
I am an iptables beginner. I want to set up my firewall to rate limit incoming packets based on a particular source IP address (but not any other IP).
I understand that there are dstlimit and hashlimit options for iptables. It is not clear to me whether these apply the same limit (x packets/sec) to each ip address (ie all IP addresses limited at x packets/sec) or whether their action can be applied to a single address (I suspect the former).
If it is the latter, can the hashlimit switch be limited by (eg) -s? Alternatively can I jump past the rule for other ip addresses?
Would either of these work?
...
-A src_limit -s !<limit_ip> -j ACCEPT
-A src_limit -m hashlimit --hashlimit 2/min --hashlimit-burst 10 --hashlimit-mode srcip,dstport --hashlimit-name per_src --hashlimit-htable-gcinterval 60000 --hashlimit-htable-expire 300000 -j ACCEPT
...
or
-A src_limit -s <limit_ip> -m hashlimit --hashlimit 2/min --hashlimit-burst 10 --hashlimit-mode srcip,dstport --hashlimit-name per_src --hashlimit-htable-gcinterval 60000 --hashlimit-htable-expire 300000 -j ACCEPT
Thanks
Brendan
Brendan S (Scratch User) írta:
Quoted 9 lines
Hi
I am an iptables beginner. I want to set up my firewall to rate limit incoming packets based on a particular source IP address (but not any other IP).
I understand that there are dstlimit and hashlimit options for iptables. It is not clear to me whether these apply the same limit (x packets/sec) to each ip address (ie all IP addresses limited at x packets/sec) or whether their action can be applied to a single address (I suspect the former).
If it is the latter, can the hashlimit switch be limited by (eg) -s? Alternatively can I jump past the rule for other ip addresses?
You can use -s switch
Review
Quoted 6 lines
Would either of these work?
...(quoted diff) +0
-2-A src_limit -s !<limit_ip> -j ACCEPT -A src_limit -m hashlimit --hashlimit 2/min --hashlimit-burst 10 --hashlimit-mode srcip,dstport --hashlimit-name per_src --hashlimit-htable-gcinterval 60000 --hashlimit-htable-expire 300000 -j ACCEPT
1. Accept EVERYTHING from EVERYONE except <limit_ip>
2. Accept EVERYTHING ELSE (from <limit_ip>) if hashlimit module permits
Quoted 6 lines
...
or-A
src_limit-s <limit_ip> -m hashlimit --hashlimit 2/min --hashlimit-burst 10 --hashlimit-mode srcip,dstport --hashlimit-nameper_src--hashlimit-htable-gcinterval 60000 --hashlimit-htable-expire 300000 -j ACCEPT
1. Accept from <limit_ip> if haslimit module permits
Quoted 6 lines
Thanks
Brendan
Do not forget the DROP policy in the chain...
Swifty