Can I use iptables to rate limit an ipset?
Solution 1:
Yes, It is.
I made a simple test using:
ipset create ratelimit hash:ip hashsize 4096
ipset add ratelimit <ip_address>
iptables -I INPUT -m set --match-set ratelimit src -p tcp --dport 80 -m hashlimit --hashlimit 10/sec --hashlimit-name ratelimithash -j DROP
and worked:
Chain INPUT (policy ACCEPT 1537 packets, 89602 bytes)
pkts bytes target prot opt in out source destination
64 7562 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 match-set ratelimit src tcp dpt:80 limit: up to 10/sec burst 5
with --hashlimit-mode srcip
worked too.