10

I want to perform rate limiting per source IP in iptables. For example, limit the rate at which a host can establish new SSH connections to 5 per minute. To my knowledge there are two ways of doing this:

With the hashlimit module

iptables -A INPUT -p tcp --dport 22 -m state --state NEW \
  -m hashlimit --hashlimit-name SSH --hashlimit-above 5/min \
  --hashlimit-mode srcip -j REJECT
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT

With the recent module

iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent \
  --rcheck --seconds 60 --hitcount 5 --name SSH --rsource -j REJECT
iptables -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW \
  -m recent --set --name SSH --rsource -j ACCEPT

My questions:

  • Is there any difference in how these two will behave?
  • With an emphasis on performance, which one is preferable?
  • Is there a significant downside to using both modules?
1
  • 1
    Hey, are you trying to protect your server from brute force?
    – fgbreel
    Oct 21, 2015 at 20:43

2 Answers 2

4
Is there any difference in how these two will behave?

No, what you wrote will functionally do the same thing.

With an emphasis on performance, which one is preferable?

Arguably, recent has better performance because it maintains a table but does not use hash buckets.

Is there a significant downside to using both modules?

I'm not sure why you would use both. You would have the performance impact of using both modules when you only need one.

0

Is there any difference in how these two will behave?

Depends on how many connections you are expecting.

On most distributions the recent module is setup to only remember a small number of addresses and packets per address; 100 and 20 respectively. So if you wanted to limit to 21 hits that wouldn't be possible with recent's default values.

Hashlimit doesn't seem to have such limits by default although the number of buckets, number of entries and expiration can be specified.

1
  • 1
    "recent" module has parameters where you can increase all the limits when the module is loaded. "hashlimit" module doesn't have any parameters, so I'm not sure what are the defaults and if they can be easily changed or not.
    – Marki555
    May 25, 2020 at 22:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .