This guide contains practical iptables examples for limiting TCP connections, connection rates, packet rates and traffic rates per source or destination IP on Ubuntu 24.04.
Two different iptables modules are important here: connlimit limits the number of simultaneous connections, while hashlimit applies rate limits independently per source IP, destination IP or source/destination pair.
Check iptables on Ubuntu 24.04
Check the installed iptables version and backend:
Ubuntu 24.04 normally uses the nftables backend through the iptables-nft compatibility tools. Standard iptables commands and the connlimit and hashlimit extensions can still be used with the familiar iptables syntax.
Limit Concurrent TCP Connections per Source IP
This example allows a maximum of 5 simultaneous connections per source IPv4 address. New connections above the limit are rejected:
The --connlimit-mask 32 applies the limit independently to every IPv4 source address. Using --syn is important because only new TCP connection attempts should be rejected; already established connections should not be interrupted.
Important: connlimit groups connections by source or destination address, not by TCP port. The rule itself is evaluated only for new connections to port 8002, but the connlimit counter is address-based. For a strict connection-attempt rate specifically for one service, use hashlimit as shown below.
Limit New TCP Connections per Source IP
Limit new TCP connections to port 8002 to approximately 10 connection attempts per minute for each source IP, while allowing a small burst:
Each source IP receives an independent rate bucket. Traffic below the configured rate continues through the INPUT chain, while connection attempts exceeding the limit are rejected.
Limit TCP Connection Rate per Source IP per Second
For services that receive more frequent connections, the same method can be used with a per-second limit. The following example limits each source IP to 20 new TCP connection attempts per second with a burst of 10:
This type of rule is useful for protecting HTTP/HTTPS services against excessive TCP connection attempts from individual clients.
Limit UDP Packets per Source IP
UDP does not have TCP-style connections, so packet rate limiting is normally more useful. This example limits traffic to UDP port 5000 to 100 packets per second for each source IP:
One client exceeding the configured rate is limited without affecting other source IP addresses.
Limit Traffic per Destination IP
On a Linux router, firewall or KVM hypervisor, the FORWARD chain can limit traffic independently for each destination server. This example limits new HTTPS connections to 200 per second for each destination IP:
The dstip mode creates an independent rate bucket for every destination IP passing through the server.
Limit Traffic per Source and Destination Pair
A separate rate limit can also be maintained for every source-to-destination IP pair:
For example, traffic from 192.0.2.10 to 203.0.113.10 gets a different rate bucket from traffic from the same source to 203.0.113.20.
Limit Connections per Source Network
Instead of applying a limit to every individual IP address, clients can be grouped by subnet. This example applies one rate limit to every /24 source network:
All source addresses within the same /24 network share the same rate bucket.
Limit Traffic Bandwidth per Source IP
hashlimit can also match traffic rates in bytes per second. The following example drops incoming TCP traffic to port 8002 when one source IP exceeds approximately 1 MB/s, with an additional 2 MB burst allowance:
This is packet dropping, not traffic shaping. If smooth bandwidth control is required instead of dropping excess packets, Linux Traffic Control (tc) should be used.
Check Rate Limit Rules and Counters
Display INPUT rules together with packet and byte counters:
For forwarded traffic:
The packet counters are useful for confirming that a rate-limit rule is actually matching traffic.
Check hashlimit Runtime Counters
Active hashlimit tables can also be inspected directly through procfs:
For example:
Rule Order Is Important
iptables processes rules from top to bottom. If an ACCEPT rule for the same traffic already exists before the rate-limit rule, the rate limiter will never be reached.
Check the current rule order with:
If required, insert a rule at a specific position instead of appending it. For example, insert a rule as INPUT rule number 3:
Save iptables Rules
iptables rules created from the command line are not persistent after reboot. On Ubuntu 24.04 they can be saved using iptables-persistent:
connlimit vs hashlimit
Use connlimit when the requirement is “maximum N simultaneous TCP connections per client”. Use hashlimit when the requirement is “maximum N packets, connection attempts or bytes per second/minute for each source or destination”.
The normal -m limit module should not be used when an independent limit per source IP is required because it provides a single shared rate limiter. Use -m hashlimit for per-IP rate limiting.