Limit UDP connections per IP iptables

Question

I want to limit connections per IP for a specific UDP port. I got it working for TCP, but somehow it doesn't work on UDP. These are my rules:

For TCP (working)

iptables -A INPUT -p tcp --syn --dport 7787 -m connlimit --connlimit-above 3 -j REJECT --reject-with tcp-reset
iptables -A INPUT -p tcp --syn --dport 7788 -m connlimit --connlimit-above 3 -j REJECT --reject-with tcp-reset

For UDP

iptables -A INPUT -p udp --dport 7787 -m connlimit --connlimit-above 3 -j REJECT
iptables -A INPUT -p udp --dport 7788 -m connlimit --connlimit-above 3 -j REJECT

According to the man pages this should work (atleast how I understand it), but I still get flooded by single IP's sometimes.

Answer 1

Your question doesn't make sense, as UDP doesn't really have "connections". There's only one conntrack entry that gets set up for each source IP/port.

Answer 2

Well it sounds pretty much plausible that your client in question uses less than 3 NFCT connections to flood you.