I have below rule:

iptables -A CHAIN_S1 -m hashlimit --hashlimit-above 20/min --hashlimit-burst 2 --hashlimit-mode srcip --hashlimit-name status_S1 --hashlimit-htable-gcinterval 5300 --hashlimit-htable-expire 30000 -j DROP

Not able to figure out exactly hashlimit-burst and hashlimit-above. Burst means it will allow first 2 packets/min and then anything above 20/min will be blocked?

A) I would like to allow 8 packets / 2 second (per IP) and anything above 20 packets/min (per IP), block the IP for 5 mins. Appreciate the help.

B) Block all packets from all IP's if it's 200 packets (all IP) / sec.

Sorted by: Reset to default

Know someone who can answer? Share a link to this question via email, Twitter, or Facebook.

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password Submit

Post as a guest

Post Your Answer Discard

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy