my understanding is that the hashlimit module of netfilter is supposed to implement the leaky bucket algorithm... i'm using the below iptables configuration
iptables -A INPUT -s 207.[...] -m hashlimit --hashlimit-above 34722b/s \ --hashlimit-burst 600m --hashlimit-name hashlimitTable1 \ --hashlimit-htable-expire 604800000 -j DROP
this works perfectly for a single large download of 700 MB but if I wait three hours after the the download completes and then do another download the rule is still matching immediately (no burst) and limiting the bandwidth to ~34kB/s.
cat /proc/net/ipt_hashlimit/hashlimitTable1 shows after the first large download
This seems to represent the burst "bucket" size and it does go down and reach 0 after 600 MB have been downloaded, but it never increases no matter how long I wait. | | 604555 0.0.0.0:0->0.0.0.0:0 4194304000 0 1931967
Does hashlimit not implement the "leaky bucket" algorithm? Or is my configuration incorrect?
man 8 iptables-extensions|grep -e 'hashlimit-burst amount' -A 7
--hashlimit-burst amount Maximum initial number of packets to match: this number gets recharged by one every time the limit specified above is not reached, up to this number; the default is 5. When byte-based rate matching is requested, this option specifies the amount of bytes that can exceed the given rate. This option should be used with caution -- if the entry expires, the burst value is reset too.
this indicates that my expected behavior is correct but maybe I need to ensure that the rule is matched from the opposite perspective:
iptables -A INPUT -s 207.[...] -m hashlimit --hashlimit-upto 34722b/s \ --hashlimit-burst 600m --hashlimit-name hashlimitTable1 \ --hashlimit-htable-expire 604800000 -j ACCEPT; iptables -A INPUT -s 207.[...] -j DROP;
Unfortunately this results in exactly the same observed behavior, even when using
wget --limit-rate=1024 http://207.[...]/testFile.bin to download at an absurdly low rate of 1KiBps for 19+ minutes, yet the max number of tokens never increases above zero and the bandwidth after waiting an additional hour without downloads is still restricted to ~34KBps...
I have confirmed that the expire time, garbage collect interval, htable-size, and htable-max do not have any effect on the problem. If I make the expire really short like 10 seconds then obviously it will reset the burst, but that would result in violating the average bandwidth.