4

Is it possible to use iptable tables to rate limit an ipset ?

I know you can use ipset to create a block list named blacklist

i.e.

ipset create blacklist hash:ip
iptables -I INPUT -m set --match-set blacklist src -j DROP
ipset add blacklist 1.2.3.4
ipset add blacklist 1.2.3.5

But how can you rate limit the ipset called blacklist ? Something like ?

iptables -I INPUT -m set --match-set blacklist src -p TCP --dport 80 -m hashlimit --hashlimit 50/sec --hashlimit-burst 10 --hashlimit-name blacklisthash -j DROP

is –hashlimit-mode srcip even needed ?

thanks

1 Answer 1

3

Yes, It is.

I made a simple test using:

ipset create ratelimit hash:ip hashsize 4096
ipset add ratelimit <ip_address>
iptables -I INPUT -m set --match-set ratelimit src -p tcp --dport 80 -m hashlimit --hashlimit 10/sec --hashlimit-name ratelimithash -j DROP

and worked:

Chain INPUT (policy ACCEPT 1537 packets, 89602 bytes)
    pkts      bytes target     prot opt in     out     source               destination
      64     7562 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set ratelimit src tcp dpt:80 limit: up to 10/sec burst 5

with --hashlimit-mode srcip worked too.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .