limit
This module must be explicitly specified with `-m limit' or `--match limit'. It is used to restrict the rate of matches, such as for suppressing log messages. It will only match a given number of times per second (by default 3 matches per hour, with a burst of 5). It takes two optional arguments:


--limit
followed by a number; specifies the maximum average number of matches to allow per second. The number can specify units explicitly, using `/second', `/minute', `/hour' or `/day', or parts of them (so `5/second' is the same as `5/s').

--limit-burst
followed by a number, indicating the maximum burst before the above limit kicks in.


This match can often be used with the LOG target to do rate-limited logging. To understand how it works, let's look at the following rule, which logs packets with the default limit parameters:

# iptables -A FORWARD -m limit -j LOG

The first time this rule is reached, the packet will be logged; in fact, since the default burst is 5, the first five packets will be logged. After this, it will be twenty minutes before a packet will be logged from this rule, regardless of how many packets reach it. Also, every twenty minutes which passes without matching a packet, one of the burst will be regained; if no packets hit the rule for 100 minutes, the burst will be fully recharged; back where we started.

 

 

iptables -t filter -A INPUT -p icmp --icmp-type echo-request  -m limit --limit 6/minute --limit-burst 6 -j LOG --log-prefix="filter INPUT:"

 

列：

 

#!/bin/bash

 

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

 

 

iptables -N syn-flood

iptables -A INPUT -i eth0 -p tcp -m state --state NEW -j syn-flood

iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN

 

 

iptables -A INPUT -i eth0 -p tcp ! --syn -m state --state NEW -j DROP

 

iptables -A INPUT -i eth0 -p tcp -d 0/0 --dport 80 -j ACCEPT

 

iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT

 

iptables -A INPUT -f -m limit --limit 100/s --limit-burst 100 -j ACCEPT

iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 3 -j ACCEPT

 

iptables -A INPUT -i eth0 -p tcp --dport 21 -j ACCEPT

iptables -A INPUT -i eth0 -p tcp --dport 20 -j ACCEPT

 

iptables -A INPUT -i eth0 -j DROP