7

I want to perform rate limiting per source IP in iptables. For example, limit the rate at which a host can establish new SSH connections to 5 per minute. To my knowledge there are two ways of doing this:

With the hashlimit module

iptables -A INPUT -p tcp --dport 22 -m state --state NEW \
  -m hashlimit --hashlimit-name SSH --hashlimit-above 5/min \
  --hashlimit-mode srcip -j REJECT
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT

With the recent module

iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent \
  --rcheck --seconds 60 --hitcount 5 --name SSH --rsource -j REJECT
iptables -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW \
  -m recent --set --name SSH --rsource -j ACCEPT

My questions:

  • Is there any difference in how these two will behave?
  • With an emphasis on performance, which one is preferable?
  • Is there a significant downside to using both modules?
  • Hey, are you trying to protect your server from brute force? – fgbreel Oct 21 '15 at 20:43
2
Is there any difference in how these two will behave?

No, what you wrote will functionally do the same thing.

With an emphasis on performance, which one is preferable?

Arguably, recent has better performance because it maintains a table but does not use hash buckets.

Is there a significant downside to using both modules?

I'm not sure why you would use both. You would have the performance impact of using both modules when you only need one.

0

Is there any difference in how these two will behave?

Depends on how many connections you are expecting.

On most distributions the recent module is setup to only remember a small number of addresses and packets per address; 100 and 20 respectively. So if you wanted to limit to 21 hits that wouldn't be possible with recent's default values.

Hashlimit doesn't seem to have such limits by default although the number of buckets, number of entries and expiration can be specified.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.