Rate Limiting

Block excessive traffic from single source. Defends against:

• Brute force (SSH, admin login).
• DDoS / floods.
• Crawlers.
• Scrapers.

Token bucket algorithm:

Each source IP has a bucket of tokens.
Add 1 token per second (refill rate).
Cap at burst size.
Each packet uses 1 token.
If empty: drop or queue.

iptables rate limit:

iptables -A INPUT -p tcp --dport 22 -m hashlimit \
    --hashlimit 10/min --hashlimit-burst 5 \
    --hashlimit-name ssh --hashlimit-mode srcip -j ACCEPT

10 SSH connections per minute per source, burst of 5.

Match-based rate limit:

iptables -A INPUT -p icmp --icmp-type 8 -m limit --limit 1/sec --limit-burst 3 -j ACCEPT

Limit pings to 1/sec.

Connection tracking + connlimit:

iptables -A INPUT -p tcp --syn -m connlimit --connlimit-above 20 -j REJECT

Max 20 concurrent connections per source.

fail2ban / sshguard:

• Userspace tools.
• Watch logs (auth.log).
• Detect brute force via failed login patterns.
• Add iptables rules dynamically (block IP for N minutes).

Modern alternatives:

• nftables: replacement for iptables. More flexible.
• Cloudflare / Akamai: DDoS at edge.
• AWS Shield: AWS-managed DDoS mitigation.

Rate limiting at multiple layers:

• L4 (firewall): per-connection rate.
• L7 (WAF, app): per-request rate.
• L7 (CDN): per-region rate.

Defense in depth: each layer absorbs some attack volume.

Be careful:

• Legitimate users from NAT (corporate, mobile) share IPs.
• Aggressive limits can affect legit traffic.
• Whitelist known partners + measured rates.