Dynamic IP Tables

Hi All,

Does anyone know if it is possible using iptables, to say if there is more than x icmp packets in x amount of time to start to block icmp packets?


1 Reply

Yes, there is a module called 'limit' which is documented in the iptables man page.

> limit

This module matches at a limited rate using a token bucket filter. A rule using this extension will match until

this limit is reached (unless the `!' flag is used). It can be used in combination with the LOG target to give

limited logging, for example.

–limit rate

Maximum average matching rate: specified as a number, with an optional /second',/minute', `/hour', or

`/day' suffix; the default is 3/hour.

--limit-burst number

Maximum initial number of packets to match: this number gets recharged by one every time the limit specified

above is not reached, up to this number; the default is 5.


Please enter an answer

You can mention users to notify them: @username

You can use Markdown to format your question. For more examples see the Markdown Cheatsheet.

> I’m a blockquote.

I’m a blockquote.

[I'm a link] (https://www.google.com)

I'm a link

**I am bold** I am bold

*I am italicized* I am italicized

Community Code of Conduct