Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to use iptable tables to rate limit an ipset ?

I know you can use ipset to create a block list named blacklist


ipset create blacklist hash:ip
iptables -I INPUT -m set --match-set blacklist src -j DROP
ipset add blacklist
ipset add blacklist

But how can you rate limit the ipset called blacklist ? Something like ?

iptables -I INPUT -m set --match-set blacklist src -p TCP --dport 80 -m hashlimit --hashlimit 50/sec --hashlimit-burst 10 --hashlimit-name blacklisthash -j DROP

is –hashlimit-mode srcip even needed ?


share|improve this question

Yes, It is.

I made a simple test using:

ipset create ratelimit hash:ip hashsize 4096
ipset add ratelimit <ip_address>
iptables -I INPUT -m set --match-set ratelimit src -p tcp --dport 80 -m hashlimit --hashlimit 10/sec --hashlimit-name ratelimithash -j DROP

and worked:

Chain INPUT (policy ACCEPT 1537 packets, 89602 bytes)
    pkts      bytes target     prot opt in     out     source               destination
      64     7562 DROP       tcp  --  *      *              match-set ratelimit src tcp dpt:80 limit: up to 10/sec burst 5

with --hashlimit-mode srcip worked too.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.