Limit ICMP Per Source IP with IPTables
I have mistakenly thought that the limit module is per source ip, but it appears to be based on all requests:
577 36987 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 3/sec burst 5
46 3478 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 LOG flags 0 level 4 prefix `INET-PING-DROP:'
46 3478 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
...
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 3/sec burst 5
0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 LOG flags 0 level 4 prefix `WEB-PING-DROP:'
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
How can I rate limit icmp with iptables / netfilter based on the source IP address?
Solution 1:
If you were still wondering for a hint:
iptables -I INPUT -p icmp -m hashlimit --hashlimit-name icmp --hashlimit-mode srcip --hashlimit 3/second --hashlimit-burst 5 -j ACCEPT
Assuming the last rule in INPUT is drop or the default policy is DROP. Each ip is limited to 3 pings a second (burst of 5). Not all incoming IPs total, as you found with -m limit.