I have set up rate-limiting to stop brute-force attacks on my ssh server. I am using the following iptables rules:
iptables -A INPUT -p tcp -m tcp --dport 22 -m hashlimit --hashlimit-upto 4/min --hashlimit-burst 6 --hashlimit-mode srcip --hashlimit-name ssh --hashlimit-htable-expire 60000 -m state --state NEW -j ACCEPT iptables -A INPUT -m tcp -p tcp --dport 22 -m state --state NEW -j REJECT
When I open one SSH connection (e.g. via PuTTY), and then, a minute later, try to open another one (for example, to transfer a file), the second connection is sometimes rejected with no response from the server. If I manage to open a second SSH connection and then try to open a third connection, it becomes even harder (high probability of no response).
I have verified that when I disable the above rules, everything works fine. Increasing
--hashlimit-burst helps, but doesn't resolve the
problem completely -- it only decreases the likelihood of it happening. Rejection still happens sometimes, whereas if I disable the iptables rule, it never happens.
What is going on? The above iptables rules say that TCP packets related to new connections should be limited to 4 per minute. So I should easily be able to open up to 4 connections per minute.