Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a work to write a iptables rules to limit the number of physical devices to connect my server, I have tried hashlimit, but it seems not work, below are my rules:

iptables -I INPUT 1 -p tcp -m hashlimit --hashlimit 1000/s --hashlimit-mode srcip,srcport --hashlimit-name hosts --hashlimit-htable-size 1 -j ACCEPT
iptables -I INPUT 2 -j REJECT

In the first line, I did a limit the to size of hashlimit, it's just 1, so according to the instructions about hashlimit from websit hashlimit of iptables, it's said:

This sets the maximum available buckets to be used. In this example, it means that a maximum of 500 ports can be open and active at the same time.

So, I guess if I set limit to 1, it's just allow one tcp connection keeped, but when I try another tcp connection with nc, I found that I still can get the connection work, so any tips?

share|improve this question
up vote 1 down vote accepted

--hashlimit-htable-size specifies the number of buckets in the hash table. Setting this to 1 means that every entry is mapped to the same bucket (i.e. you're limiting globally, regardless of src/dst). This parameter isn't required, so you should just omit it.

The allowed rate is specified by the --hashlimit option, which you've set to 1000/s, and so 1000 packets per second will be allowed.

You're also hashing on the source port which will change with every connection attempt the client makes, and so you're not going to actually limit anything.

The rule you want is something like this:

iptables -I INPUT 1 -p tcp -m hashlimit --hashlimit 1/s --hashlimit-mode srcip --hashlimit-name hosts -j ACCEPT
share|improve this answer
thanks very much, I'll try it! – liunx Mar 15 '13 at 8:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.