I am using iptables' rate-limit module to prevent DoS attack (I know it cannot stop a full scale DDoS but at least it can help with smaller attacks).
In my rules I have something like:
/sbin/iptables -A INPUT -p TCP -m state --state NEW -d xx.xxx.xxx.xx --dport 80 -m limit --limit 20/minute --limit-burst 20 -j ACCEPT
It works well until last night when someone was hitting my port 80 non-stop. The connection was being dropped per the rule alright (as shown in the log). However, it also makes the server unavailable to other legitimate users as well.
I don't understand why it happened like that. I thought it would not affect any other users besides the one that is flooding the server.
Is it because iptables was overwhelmed?
Any feedback would be greatly appreciated.