Can I use iptables to rate limit an ipset?

Solution 1:

Yes, It is.

I made a simple test using:

ipset create ratelimit hash:ip hashsize 4096
ipset add ratelimit <ip_address>
iptables -I INPUT -m set --match-set ratelimit src -p tcp --dport 80 -m hashlimit --hashlimit 10/sec --hashlimit-name ratelimithash -j DROP

and worked:

Chain INPUT (policy ACCEPT 1537 packets, 89602 bytes)
    pkts      bytes target     prot opt in     out     source               destination
      64     7562 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            match-set ratelimit src tcp dpt:80 limit: up to 10/sec burst 5

with --hashlimit-mode srcip worked too.